Coder Legion - Recent posts tagged reset

How to Reset the WAF Admin Account Inside Docker

Sat, 31 Oct 2026 02:37:39 +0000

Losing the SafeLine console password usually starts with a reasonable but wrong edit. After installation, the web UI is opened at https://<safeline-ip>:9443/, and the deploy guide does not store that login in the Compose environment file. Resetting the administrator account is a container command. The failure mode below is one concrete mix-up: treating POSTGRES_PASSWORD as the console password, then trusting a restart that never printed a new admin credential.

What was misconfigured

A manual install keeps SafeLine configuration and data in a directory you create. The deploy guide at https://docs.waf.chaitin.com/en/GetStarted/Deploy uses /data/safeline as the example. Inside it, .env holds SAFELINE_DIR, IMAGE_TAG, MGT_PORT, POSTGRES_PASSWORD, SUBNET_PREFIX, and several generated secrets. That same guide defines POSTGRES_PASSWORD as the Postgres database initialization password. It is consumed when the database is initialized. It is not the account you type into the management UI.

The misconfiguration looks like this. The operator cannot log in, opens .env, replaces POSTGRES_PASSWORD, optionally rewrites DETECTOR_MGMT_TOKEN or MGT_INTERNAL_TOKEN, and runs docker compose up -d again. Compose can bring the stack process up. That result does not print an administrator username or a console password. The web account was never that database variable, so the edited string is the wrong secret for the login form.

File mode is a related dead end. The guide sets .env to mode 600 and restricts resource directories such as resources/mgt and resources/postgres/data. Those permissions protect local secrets and sockets. Changing them does not rotate the console user.

Reset the account inside the management container

Use the procedure in the deploy guide, in order.

Confirm the host meets the documented dependencies before you blame the password command: Linux, x86_64 or arm64, Docker 20.10.14 or above, and Docker Compose 2.0.0 or above. The guide also lists a minimum of 1 core CPU, 1 GB memory, and 5 GB disk, plus the ssse3 CPU flag. Those checks explain a stack that never became ready. They are not a second password store.

From the SafeLine directory that contains compose.yaml and .env, start the services with docker compose up -d. The guide warns that this can take several minutes. When it finishes, request the administrator account from inside the management container:

docker exec safeline-mgt resetadmin

The container name in that command is safeline-mgt. Do not point docker exec at the Postgres image named in .env, and do not expect the automatic installer shell to reprint the password later. The documented recovery for the administrator account is this exec, described under Get Administrator Account in https://docs.waf.chaitin.com/en/GetStarted/Deploy.

The screen that confirms the fix

Success is a terminal screen, not a Compose health line. The deploy guide says that after the command succeeds you must remember the printed content. The confirming text begins with the sentence Please must remember this content. It then prints three [SafeLine] lines: initial username admin, initial password, and Done. The password in the guide is shown masked. On your host, copy the characters that appear in that password field. Asterisks in the documentation are not the credential.

If that remembered-content screen is absent, the reset is not confirmed. Do not fall back to POSTGRES_PASSWORD, and do not paste a token from .env into the login form. DETECTOR_MGMT_TOKEN and MGT_INTERNAL_TOKEN are internal values written during setup. The guide does not present them as console passwords.

After the screen is present, open the console with HTTPS on the SafeLine host and the console port. The documented URL is https://<safeline-ip>:9443/. MGT_PORT is defined as the web console port, and the sample .env sets it to 9443. If you changed MGT_PORT before startup, use that port instead. MGT_PROXY is the number of console proxy layers. The sample keeps it at 0 when no console proxy is configured. It does not replace resetadmin.

The guide then says to enter the password from the previous step, after which you are logged into SafeLine. A successful login with that exact password is the second confirmation. Seeing a block page on a test request only proves that a protected application filtered an attack, as described in https://docs.waf.chaitin.com/en/GetStarted/AddApplication. It does not prove that the admin reset ran.

What not to reset by accident

SafeLine is a self-hosted web application firewall, per https://docs.waf.chaitin.com/en/home. Deployed in front of an application, it is a reverse proxy: clients reach SafeLine first, malicious HTTP and HTTPS traffic is filtered, and safe traffic is forwarded to the upstream. The same overview lists defenses against attacks such as SQL injection, XSS, command injection, path traversal, SSRF, and brute force, plus rate limiting, CAPTCHA challenge, authentication challenge, and dynamic HTML and JS protection. None of that is configured by the admin reset command.

Application proxy settings are entered after login. The protecting-applications guide tells you to open Applications, add an application, and set domain, listen port, and upstream. Resetting the console user does not document a change to those fields.

Do not uninstall to recover a password. Uninstall, in the same deploy guide, is docker compose down in the SafeLine directory and then removal of that directory. That deletes local configuration and data. It is a different operation from docker exec safeline-mgt resetadmin.

Close the loop with the original mistake

Before you leave the host, check four facts against the screen you just saw. The stack was started with docker compose up -d. The reset targeted safeline-mgt. The terminal showed the remember-this-content notice, username admin, a password, and Done. The browser used HTTPS and MGT_PORT, normally 9443, with the password copied from that screen rather than from POSTGRES_PASSWORD.

Why does editing POSTGRES_PASSWORD fail to reset the console admin?

The deploy guide defines POSTGRES_PASSWORD as the Postgres initialization password in .env. The documented way to obtain the console administrator account is docker exec safeline-mgt resetadmin. A Compose restart can leave the web password unchanged because that variable was never the console credential.

How do I know the container reset actually finished?

The confirming screen is the output documented for resetadmin: the notice to remember the content, then [SafeLine] lines for initial username admin, initial password, and Done. No other log in the install guide is described as that credential. If those lines are missing, there is no new admin password to type.

Which URL matches the password I just reset?

Log in at https://<safeline-ip>:9443/ unless MGT_PORT in .env was set to another console port. Use HTTPS. The upstream site you are protecting is not the management UI, and a guess on the application listen port will not submit this credential to the console.

Can I reset the admin account before docker compose up finishes?

The guide places Get Administrator Account after Launch SafeLine. Run docker compose up -d first and allow the start, which may take several minutes. resetadmin is an exec into safeline-mgt, so the management container has to be there for the command to return the success screen.

Will this admin reset delete applications or replace the database password?

The documented command prints an initial username and password for the console. It does not say that applications, upstreams, or POSTGRES_PASSWORD are rewritten. Removing the install directory is the uninstall path, and that path does delete SafeLine data, so keep uninstall and admin reset separate.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

SafeLine website: https://ly.cyberserval.tech/MqhYdmI
Demo: https://demo.waf.chaitin.com:9443/statistics
Official docs: https://docs.waf.chaitin.com/en/home
GitHub: https://github.com/chaitin/SafeLine
Pro offer: https://cyberserval.tech/landing/lto

Why I Run a Checklist Before Turning Protection On

Sat, 31 Oct 2026 02:37:07 +0000

I do not turn protection on in the same hour I install a web application firewall. SafeLine sits in front of the origin as a reverse proxy, so a rushed cutover can lock operators out of the console or send visitors to the wrong upstream. The product documentation describes SafeLine as a self-hosted WAF that filters and monitors HTTP traffic between a web application and the Internet, blocking malicious requests and stopping unauthorized data from leaving the app by applying policies that separate malicious traffic from safe traffic (https://docs.waf.chaitin.com/en/home). That architecture is why I keep a decision checklist, and why the first operational question is how to reset the WAF admin account inside Docker before any site depends on the proxy.

Confirm the host before you trust the console

The deploy guide sets a floor I will not negotiate: Linux, x86_64 or arm64, Docker 20.10.14 or above, Docker Compose 2.0.0 or above, and at least 1 CPU core, 1 GB of memory, and 5 GB of disk. The CPU must support ssse3. The same page lists the checks I actually run: uname -m, docker version, docker compose version, processor and memory inspection, df -h, and an lscpu filter for ssse3 (https://docs.waf.chaitin.com/en/GetStarted/Deploy). If any line fails, protection stays off. On ARM, that guide states that SafeLine requires a Pro license to work properly and that the Personal Edition is not supported on ARM. I treat that as a stop, not a footnote. I also decide the release track before launch. The guide says the LTS line will no longer be maintained starting from 9.1.0-LTS (14 August 2025) and strongly recommends an upgrade to the latest version. I do not put a new site behind an unmaintained image tag just because the compose file still accepts RELEASE=-lts.

Recover the admin account while the shell still works

After the stack is up, the deploy guide says to open the web console at https://<safeline-ip>:9443/ and to get the administrator account with this command:

docker exec safeline-mgt resetadmin

A successful run tells you to remember the printed content. It shows an initial username of admin, an initial password, and a done line. I run that command from the Docker host, store the password outside the server, and log in once before I add an application. This is the documented way to obtain the administrator account inside Docker. I do not invent a database edit, a second container name, or a custom reset flag. If the command fails, the container is unhealthy, or I cannot read the password, I am not ready to proxy production traffic. The management UI is how I will later add sites and read the attack list, so a console I cannot enter is a failed checklist, not a minor inconvenience.

Secrets sit next to that login drill. A manual install keeps configuration in a directory such as /data/safeline, including POSTGRES_PASSWORD and the generated detector and management tokens, and the guide sets .env to mode 600. MGT_PORT is the console port, 9443 in the sample. MGT_PROXY is the number of console proxy layers and should stay at 0 unless a console proxy is actually being configured (https://docs.waf.chaitin.com/en/GetStarted/Deploy). Before protection is on, I decide who can reach port 9443 and who can read .env. I do not change MGT_PROXY to paper over a login problem.

Decide the proxy path, then decide which controls to enable

SafeLine is an nginx-based reverse proxy. It receives traffic for the original site, cleans malicious traffic, and forwards the remainder to the original application (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). In the Web Admin Console, Add Application asks for Domain, Port, and Upstream. Domain may be a domain name, a hostname, or an IP. Port is what SafeLine will listen on, such as 80 or 443, and HTTPS apps need the SSL option checked. Upstream is the real address used for forwarding. After those values are saved, the domain must resolve to the SafeLine server. If DNS still points at the origin, the site is not protected. If Upstream is wrong, the site is down. I write the three values down and test resolution before I call the change complete.

The feature choice is a separate decision. Documented capabilities include defenses against SQL injection, XSS, code injection, OS command injection, CRLF injection, LDAP injection, XPath injection, RCE, XXE, SSRF, path traversal, backdoor, brute force, HTTP flood, and bot abuse, plus IP-based rate limiting and a web access control list (https://docs.waf.chaitin.com/en/home). The feature list also describes CAPTCHA so human visitors can pass while crawlers and bots are blocked, an authentication challenge that requires a password or else blocks the visitor, and dynamic protection that encrypts HTML and JS on each visit. I do not turn every one of those on during the first cutover. Challenges, dynamic encryption, and tight rate limits change what a legitimate user receives. My default is to prove the proxy and basic attack handling first, and to enable a challenge or dynamic encryption only after I can name the user impact.

I prove the path with the samples in the application guide, not with live customers. That page shows test requests for SQL injection, XSS, path traversal, code injection, and XXE, and says a blocking page means the attack was defended. I then open the console attack list and a detail view (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). A normal request should reach the upstream. A documented attack-style request should block or at least show up in that list. If neither happens, I do not declare protection on. I correct the proxy path and repeat the test.

My go or no-go order is fixed. The host meets the documented CPU, memory, disk, Docker, Compose, and ssse3 requirements, and the ARM license rule is already satisfied if the server is ARM. docker exec safeline-mgt resetadmin has printed an admin password I have stored, and I have logged in on port 9443. Domain, listen port, and upstream are recorded, and DNS points at the SafeLine host. I know which extra controls stay off on day one. One safe request is forwarded and one documented attack-style request is visible as a block or in the attack list. Any failed line means protection stays off.

How do I reset the WAF admin account inside Docker?

On the Docker host, run the command from the deploy guide: docker exec safeline-mgt resetadmin. Success output shows an initial username of admin and an initial password. Store that password and log in at https://<safeline-ip>:9443/ before you add an application. These pages do not describe another reset method, so I do not improvise one inside the database container.

No. Adding an application and reading the attack list both happen in the Web Admin Console. If resetadmin fails or port 9443 is unreachable from your admin network, leave visitor traffic on the origin until the operator path works.

What has to be true before an application is actually protected?

SafeLine must already be installed, the application entry needs Domain, Port, and Upstream, and the domain must resolve to the SafeLine server IP. Protection is that reverse-proxy path plus inspection. A saved form with DNS still aimed at the origin is not protection.

Which controls do I leave off on the first cutover?

I leave CAPTCHA, the authentication challenge, dynamic HTML and JS encryption, and aggressive rate limits off until I have seen normal traffic through the proxy. Those controls are documented, and they change the visitor experience. I validate attack handling with the published test payloads first.

Does this checklist replace the install guide?

No. Automatic install, the compose file, environment variables, permissions, and uninstall steps belong to the official deploy guide. This list is only the set of decisions I finish after install and before real users pass through the proxy. If a recovery or tuning step is not in the supplied install or application docs, I stop rather than invent it.