Master password warning

GeoServer uses a master password used to safely store security certificates. Several security warnings are associated with the master password, as a settings allows this password be used to login as the root user.

Required:

  • When upgrading you may receive a warning to change the master password from a historical default.

  • When setting up GeoServer for the first time removing the generated masterpw.info file to address security warning

Reference:

Remove master password has not been changed from the default warning

  1. When upgrading an early GEOSERVER_DATA_DIRECTORY setup you will be asked replace the default master password.

    The master password for this server has not been changed from the default. It is highly recommended that you change it now.

    Click Change it link to open the Change Master Password page.

    ../../_images/histroical_warning.png

    Change master password warning

  2. Change the master password using:

    Current password

    geoserver

    New Password

    New password definition. Master password policy requires at least eight characters.

    Confirmation

    Retype your new password
    `admin` user configuration link

    Change master password

  3. Press Change Password to set the new master password.

Remove masterpw.info warning

When the GEOSERVER_DATA_DIR/security folder is created a masterpw.info is created for your referemce.

To remove the masterpw.info file:

  1. The Welcome page displays the following warning to administrators:

    Please read the file security/masterpw.info and remove it afterwards. This file is a security risk.

    ../../_images/masterpw_warning.png

    masterpw.info warning

  2. Navigate to Tools page, and open Resource browser.

    ../../_images/tools1.png

    Tools page

  3. Select security/master.pw.info and Edit to view the contents of the file.

    Make a note of this password for your records.

    The contents are generated when the security folder is created, so your password will be different from the one shown below.

    ../../_images/masterpw.png

    Edit master.pw.info file

  4. Select security/master.pw.info and Delete to remove the file and address the warning on the welcome screen.

    ../../_images/masterpw_delete.png

    Delete master.pw.info file