Superuser blocked

Worker Joined: May 07, 2006 Posts: 172

Had a message from a superuser admin.

Quote:

I cannot change my password. Every time I go Admin-Users-Admin I get ip blocked. I have now protected my ip from being blocked, if i go Users-Admin I now get Access Denied.

Could anyone help with this please.

Site Admin Joined: Aug 22, 2007 Posts: 1774

Only the god admin user can modify other admin accounts.

Posted: Fri Sep 07, 2012 12:39 pm

I thought they could modify their own account though. Is that not the case then?

Posted: Mon Sep 10, 2012 9:10 am

Just a bump really. Very Happy

So can a superuser change their own password or not?

Thanks

Edit: worked out the other question so removed it.

Posted: Mon Sep 10, 2012 9:43 am

Its a simple answer: no. Smile

Only the god admin user can modify admin accounts. That is the reason why get the message: "Access Denied". Try it self...

Posted: Mon Sep 10, 2012 9:47 am

Thanks.

I recommended he changed his password every now and then, now I'll have to tell him he can't.

Seems strange a user can change their password but an admin can't though.

Posted: Mon Sep 10, 2012 9:54 am

Its not strange - this is best solution. Remember, the admin pw is the AUTH in the .staccess file and only you as god admin can write the .staccess. Admins should always be administered by only an account. Everything else is in my eyes a security risk.

Posted: Mon Sep 10, 2012 9:56 am

Fair enough.

Thanks again

Posted: Mon Sep 10, 2012 3:23 pm

Anyone with PHPmyadmin access can change any password, anytime for anyone.

Posted: Mon Sep 10, 2012 4:05 pm

Anyone with PHPmyadmin access can change the md5 hash, he must decrypt the PW to get it but if anyone has access to PHPmyadmin, then he has a god-admin user and don't need the PHPmyadmin access for changing a super-user PW but a super-user without a PHPmyadmin access needs anyone with a god-admin user to change the own PW. This is an fact, too! Smile

Posted: Sun Sep 16, 2012 9:04 am

These are good points that you bring up. Just to clarify a bit though, there are up to two passwords associated with an Admin: 1) admin.php login, which is what gets stored in the core *Nuke DB table, and 2) if enabled, the .staccess protection of admin.php file itself (really an Apache provided protection).

For 1), I do find it odd that one cannot change their password. Maybe that should be allowed and brought in as a feature.

However, for 2), this is more of a site owner/operator decision point on whether access to admin.php should be changed and it is separate from 1) and managed and stored in a NukeSentinel(tm) table. This one needs to be managed still, in my opinion, by the site owner/operator, otherwise known as the "God" admin.

Thoughts?