Reset Passwords for All Users?

[brandon515]

Is there a way I can reset the passwords for all users and then send them all and email letting them know how to proceed?

[snakes1100]

Phpmyadmin, go to the user table, drop the password column, then add it back, with the same details (varchar32, adjust priv's etc....)

Mass mail your users with this:

Hello $username,

We have recently had a issue with the site, please reset your password via the link below.

http://www.yoursite.com/forum/login.php?do=lostpw&email=$email

Thanks Staff

[TheLastSuperman]

For some that might be a bit "much" and they could potentially mess up the table if they don't add it back properly.

I would instead run this query:
UPDATE `user`
SET `password` = MD5(CONCAT(MD5('HibbityJibbityBl@hBl@h'), `user`.`salt`))
WHERE `userid` != 1;

Be sure to change the primary Admin password if userid = 1 before anything IF you've been hacked/compromised.

Now everyone's password is:
HibbityJibbityBl@hBl@h

DON'T TELL THEM THAT THOUGH, now simply email as Snakes said to all members and let them know to request a password reset, once they do a password request reset it will reset their password. Before you run the query replace HibbityJibbityBl@hBl@h with a long password of your own that no one would know.

[z3r0]

I've used this in the past when I had to reset all passwords and email all users on one of my vb4 boards.

https://vborg.vbsupport.ru/showthread.php?p=479904#post479904

[x iJailBreak x]

Be sure to change the primary Admin password if userid = 1 before anything IF you've been hacked/compromised.

I would expand on this to say this needs to be done for all administrators/staff accounts, regardless of how much access they have. And enforcing a 2FA solution (at least on staff accounts including administrators and moderators) such as Google Authenticator also goes a long way when it comes to protecting your users and website from malicious users.

[scottkoz20]

I would expand on this to say this needs to be done for all administrators/staff accounts, regardless of how much access they have. And enforcing a 2FA solution (at least on staff accounts including administrators and moderators) such as Google Authenticator also goes a long way when it comes to protecting your users and website from malicious users.

is there a good 2FA modification that exists?

[x iJailBreak x]

is there a good 2FA modification that exists?

For vB4, yes. I used to use a modification that I wrote myself, however as it's not commercially available (and likely never will be) I would suggest looking at DBTech Two Factor Authentication (https://vbulletin.org/forum/showthread.php?t=309138). This should achieve the same as what my own plugin did. 2FA really beefs up the security of your platform when used correctly!

[TheBang]

I would instead run this query:
UPDATE `user`
SET `password` = MD5(CONCAT(MD5('HibbityJibbityBl@hBl@h'), `user`.`salt`))
WHERE `userid` != 1;

It's probably not a great idea to set everyone's password to the same thing, no matter how obscure.

This is probably a better idea:

UPDATE `user`
SET `password` = NULL
WHERE `userid` != 1;
This basically invalidates everyone's password (except for userid 1). No one will be able to authenticate until they go through the password reset process and select a new password.