admin login not working after latest upgrade

marius008

Hello everyone,

after updating our Mailcow stack (including the database container upgrade from MariaDB 10.5 → 10.11), the entire system seems to run normally — mails are processed, SOGo works, all containers are healthy — but the web admin login is no longer possible.

🧠 Situation
• Mailcow version: current master branch as of late October 2025
• Database upgrade successfully completed (mysql_upgrade: upgrade was applied)
• All Mailcow containers show healthy in docker-compose ps
• Mails are being sent/received correctly

Only the Admin login at /admin fails with “Invalid credentials”.
Other user accounts (mailboxes) and SOGo logins work fine.

🔍 What we tried so far
1. Executed ./helper-scripts/mailcow-reset-admin.sh →
returns Access denied for user ‘mailcow’@‘localhost’ (socket auth issue).
2. Verified DB connection manually via
source mailcow.conf
docker-compose exec mysql-mailcow mysql -u${DBUSER} -p${DBPASS} -h localhost ${DBNAME}
→ works fine.

3.	Tried resetting the admin password manually:
•	via SQL UPDATE admin SET password=… with new BCrypt hashes
•	via password_hash() inside the PHP container

→ changes are visible in DB, but login still fails.
4. Tried with simple passwords (no special chars), cleared caches, restarted PHP/Nginx/SOGo.
→ still “Login failed”.

📊 Observations
• The admin table still exists, entry looks normal.
• Old hash formats ($6$…) no longer work.
• New {BLF-CRYPT}$2y$10$… or $2y$10$… hashes are accepted in DB,
but authentication via UI fails anyway.
• There are no explicit PHP errors in logs, just “login failed” on the admin page.

❓Question

Has anything changed recently in how Mailcow validates admin credentials
(e.g. hashing, salt, prefix, or login scope)?
Is there a known migration step or script for converting old admin passwords
after upgrading MariaDB / Mailcow?
Or is there a new required procedure to recreate the admin user correctly?

Any pointers or confirmations from others facing the same issue would be greatly appreciated.

Thanks in advance!

Marius

pkernstock

Are you using the admin portal for login (see mailcow/mailcow-dockerizedissues/6503)?

esackbauer

This is the correct link:
mailcow/mailcow-dockerized6503
@marius008 seems you are not reading release notes, even if you were asked to do so?

marius008

I’m using the seperate login and also read the release notes. I always get an authentication failed. I reset the password already a lot of times. But, the helper script always says, when resetting, that it cannot authenticate against MySQL. Although I can authenticate when ssh-ing into the container… I don’t get what’s going wrong here…

esackbauer

From which version did you upgrade? because DB upgrade and new login pages are 2 different major updates.
If you did update directly from a rather old version like 2024-10 than this might be the cause. You should try to upgrade from each release to the next.

marius008

Ok, I finally managed to fix it. Calling ./helper-scripts/mailcow-reset-admin.sh always gave me the MySQL auth error.

But!!! Running the commands manually helped:

root@host2 /var/local/mailcow-dockerized # source mailcow.conf
root@host2 /var/local/mailcow-dockerized # docker ps -qf name=mysql-mailcow
root@host2 /var/local/mailcow-dockerized # random=$(</dev/urandom tr -dc _A-Z-a-z-0-9 2> /dev/null | head -c${1:-16})
root@host2 /var/local/mailcow-dockerized # password=$(docker exec -it $(docker ps -qf name=dovecot-mailcow) doveadm pw -s SSHA256 -p ${random} | tr -d '\r')
root@host2 /var/local/mailcow-dockerized # docker exec -it $(docker ps -qf name=mysql-mailcow) mysql -u${DBUSER} -p${DBPASS} ${DBNAME} -e "DELETE FROM admin WHERE username='admin';"
root@host2 /var/local/mailcow-dockerized # docker exec -it $(docker ps -qf name=mysql-mailcow) mysql -u${DBUSER} -p${DBPASS} ${DBNAME} -e "DELETE FROM domain_admins WHERE username='admin';"
root@host2 /var/local/mailcow-dockerized # docker exec -it $(docker ps -qf name=mysql-mailcow) mysql -u${DBUSER} -p${DBPASS} ${DBNAME} -e "INSERT INTO admin (username, password, superadmin, active) VALUES ('admin', '${password}', 1, 1);"
root@host2 /var/local/mailcow-dockerized # docker exec -it $(docker ps -qf name=mysql-mailcow) mysql -u${DBUSER} -p${DBPASS} ${DBNAME} -e "DELETE FROM tfa WHERE username='admin';"

I really don’t get where the helper-script fails because I just copied the commands out of it. Without the ifs and elses…

So, if anyone stumbles upon the same issue, just copy those commands and you are good to go… 🙂

The jump of 2 releases could have been the issue. Thanks to the community anyway. 🙂