search

sonatype / nexus-public

Sonatype Nexus Repository Open-source codebase mirror
https://www.sonatype.com/products/repository-oss-download
Eclipse Public License 1.0
1.9k stars 564 forks source link

`/nexus-data/admin.password` gets re-created on Nexus restart. #458

Open AllRWeak opened 3 weeks ago

AllRWeak commented 3 weeks ago

When using Nexus Docker image sonatype/nexus3:3.71.0 on initial install /nexus-data/admin.password file gets created. After logging in from the web console (or API) and changing the initial admin password the file gets deleted. When restarting the container the file gets re-created again although the admin password has been changed. This did not happen in previous versions is it a bug or an intended feature?

PiR-B commented 2 weeks ago

Hi,

Could you please let us know if this is intended behavior or not ?

Regards

mrprescott commented 2 weeks ago

Can you confirm if you're required to use the password in the re-created file to log in, or is your desired admin password still usable? (I realize this isn't your exact question.)

Can you also confirm if this is every time you restart, or only after restarting having done a database migration to H2?

PiR-B commented 2 weeks ago

Hi @mrprescott,

From my side I can confirm that the "re-generated" admin password is not usable. From another side I can also confirm that every time I restart the service the /opt/sonatype/sonatype-work/nexus3/admin.password is regenerated.

I tried on a fresh install with nexus 3.71.0-06

Regards

AllRWeak commented 2 weeks ago

Hi @mrprescott,

From my side I can confirm that the "re-generated" admin password is not usable. From another side I can also confirm that every time I restart the service the /opt/sonatype/sonatype-work/nexus3/admin.password is regenerated.

I tried on a fresh install with nexus 3.71.0-06

Regards

Yes exactly. I think this should not be the intended behavior that the admin.password gets regenerated even if it has been changed and the new one works.

AllRWeak commented 1 week ago

The same, I would call it, issue is also present in the latest 3.72.0 release.

dhs-rec commented 1 week ago

This is not restricted to the Docker images. I see re-appearing admin.password files after every update since 3.70.x, using the Unix tar.