account

I was helping with `realmd` account creation today, and wanted to add some of my own documentation from the personal exchange to further help the public with technical literacy for this topic.

https://www.getmangos.eu/wiki/referenceinfo/otherfiles/managing-user-accounts-using-3rd-party-apps-r20088/

This page actually provides this more generic information well, but wanted to link that to here for that reason, and also in case I can add anything more useful too.

My statements are not producing the same value, but this is the clarified process, with differing examples.

Remember to replace `username` and `password` with your intended, respective values, and your resulting SHA1 hash will most likely be different than my `5b...78` hash.  For the shell command examples, I provide alternatives that request user input to compete, to make this more obvious.

Using the MariaDB included, or associated, GUI application client, HeidiSQL:

https://www.heidisql.com/help.php#queries

I use DBeaver, but have also used MySQL Workbench in the past, along with SequelPro for Apple computers, and Navicat even longer ago.

The base SQL, mentioned above, that I also wanted to represent a bit differently:

`SELECT SHA1(CONCAT(UPPER('username'), ':', UPPER('password')));`

Fish shell command line statements:
```
⋊> echo -n 'SELECT SHA1(CONCAT(UPPER(\'username\'), \':\', UPPER(\'password\')));' | mariadb -s -p"$dbRootPP";
5b039d152722e351c8bdebcf06fd8cd4e5244d78

⋊> echo -n 'SELECT SHA1(\''(read -P 'Username: '| upcase)':'(read -P 'Password: '| upcase)'\');' | mariadb -s -p"$dbRootPP";
Username: username
Password: password
5b039d152722e351c8bdebcf06fd8cd4e5244d78

⋊> echo -n 'USERNAME:PASSWORD' | sha1sum | cut -d' ' -f1
5b039d152722e351c8bdebcf06fd8cd4e5244d78

⋊> echo -n (read -P 'Username: '| upcase)':'(read -P 'Password: '| upcase) | sha1sum | cut -d' ' -f1
Username: username
Password: password
5b039d152722e351c8bdebcf06fd8cd4e5244d78

⋊> echo -n 'USERNAME:PASSWORD' | openssl sha1 | cut -d' ' -f2
5b039d152722e351c8bdebcf06fd8cd4e5244d78

⋊> echo -n (read -P 'Username: '| upcase)':'(read -P 'Password: '| upcase) | openssl sha1 | cut -d' ' -f2
Username: username
Password: password
5b039d152722e351c8bdebcf06fd8cd4e5244d78

⋊> echo -n 'USERNAME:PASSWORD' | /usr/bin/openssl sha1 | cut -d' ' -f2
5b039d152722e351c8bdebcf06fd8cd4e5244d78

⋊> echo -n (read -P 'Username: '| upcase)':'(read -P 'Password: '| upcase) | /usr/bin/openssl sha1 | cut -d' ' -f2
Username: username
Password: password
5b039d152722e351c8bdebcf06fd8cd4e5244d78

```

My environment:
```
⋊> neofetch --stdout distro kernel shell term
distro: Fedora release 39 (Thirty Nine) x86_64
kernel: 6.6.13-200.fc39.x86_64
shell: fish 3.7.0
term: gnome-terminal

⋊> mariadb --version
mysql  Ver 15.1 Distrib 10.1.21-MariaDB, for debian-linux-gnu (x86_64) using readline 5.2

⋊> sha1sum --version
sha1sum (GNU coreutils) 9.3
Copyright (C) 2023 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by Ulrich Drepper, Scott Miller, and David Madore.

⋊> openssl version
OpenSSL 1.1.1b  26 Feb 2019

⋊> /usr/bin/openssl version
OpenSSL 3.1.1 30 May 2023 (Library: OpenSSL 3.1.1 30 May 2023)
```

The only remaining problem was that the new account, or at some point, any account, were all receiving messages that they were banned, or the account closed, and could basically not login using the WoW client.
Changing `LogLevel` to '2' in `realmd.conf` helped show us a message about an AuthChallenge code module reporting "Banned IP ...".

https://github.com/search?q=repo%3Amangos%2Frealmd banned&type=code
https://github.com/mangos/realmd/blob/8c08d47a9a3e6c64007be67074e7c587a5e63e5e/Auth/AuthSocket.cpp#L375

This could be answered in another article, and I may have seem some posts mentioning various strategies, but I want to briefly list the possible solutions for these other problems here, since they are at least close in function and process.

What may have fixed this these problems, while even using the localhost IP address 127.0.0.1 in the `realmd.conf` file, is restarting the realmd process.

https://www.getmangos.eu/forums/topic/10721-says-my-account-is-closed/#comment-79515
https://www.getmangos.eu/forums/topic/10690-stuck-on-connected/#comment-79328

For specific account problems, try using the same localhost IP address as the `localAddress`, but changing the `address` field to the external IP address of the machine the server is being hosted on.  An alternative is deleting the `address` field record's data.

We also checked reduced `failedLogins` to '0', any `active` field to '1', or `locked` to '0', and checking there was no matching record for either IP address in the `ip_banned` table, or even that it was empty.

Also, for any solution in this post, make sure all database changes are saved/persisted, so you can reload and find the data you updated again, which is more applicable when using GUI application clients to interact with a database, but also any command line execution in case errors are reported there too.

Hi SHA1 was the way it was encrypted back when it had also the value 

sha_pass_hash

That value no longer exists, it has sessionkey (which i believe is not required) and v,s. I assume v is verifier and s is salt, what encryption method is used though im trying to create a registration page i tried SHA1 and it didnt work (even though data were inserted in the db it wouldn't log me in the game) and i also tried converting it into SHA256 which also didn't work again data inserted but still couldn't login. From the terminal of mangosd it works but im trying to achieve acc creation via php.

https://github.com/mangos/realmd/blob/master/Auth/AuthSocket.cpp#L393

Seems to still use that hash.
This document mentions them as the validated and salt vlues.

https://github.com/mangos/realmd/blob/master/Auth/AuthSocket.cpp#L225
`AuthSocket::_SetVSFields` has its code you can view, and mentions this:
https://en.wikipedia.org/wiki/Secure_Remote_Password_protocol

And the similar with these code sections too:
https://github.com/mangoszero/server/blob/master/src/game/WorldHandlers/AccountMgr.cpp#L80
https://github.com/mangoszero/server/blob/master/src/game/WorldHandlers/AccountMgr.cpp#L380
`AccountMgr::CalculateShaPassHash`

I also see this website account creation code sample too:

https://github.com/i-am-fyre/BasicCMS/blob/master/main.py#L94

Maybe you don't need the other values.
They could just be temporary per auth exchange with a client following SRP.

Seems to be based on this code:
https://github.com/mangoszero/server/blob/master/src/game/WorldHandlers/AccountMgr.cpp#245

With this only using the 2 values:
https://github.com/mangoszero/server/blob/master/src/game/WorldHandlers/AccountMgr.cpp#361

It's possible you aren't colon-concatenating them first.

I also don't think that the property is version specific, and is still used for all older, vanilla clients, since realmd handles account procedures, and is a submodule to all of the server projects.

Hi, First of all thanks for your reply
My main problem here is that in the code snippets you have provided (which i also found when researching) they have a value called:
sha_pass_hash --> This is a value that doesnt exist in my DB at this moment, i dont know if its been revised, i assume so, if i find older versions of the Mangos then its there, i tried to Frankenstein it and use the DB which had the sha_pass_hash value and the rest of the build as is but it doesnt accept it, it says maps vmaps etc dont have correct version and won't start. I tried SRP6 method and even though i seem to be on the right path (hashes seem to match with other entries created by mangos terminal) game still wont accept the credentials when trying to actually login.

Hello PG711,

sha_pass_hash is still used to store the hashed password and the column should be created during database setup.

https://github.com/mangos/Realm_DB/blob/413ef9fe4de97755aff1d987c81a30a3dd762b83/Setup/realmdLoadDB.sql#L55

If it isn't there, please check your database.

Hello Parge, I've managed to resolve the issue, i think im running a "downgraded" version of it judging by the icons of mangosd.exe and realmd but now account creation works like a charm  so all and all its perfect now 

Just to document for others:

This might be a problem using server software that is not actually supported by this organization, but could be similarly-named, such as CMangos or other various and specific repacks of either, causing these differences, which is why it is recommended to access the software from here or GitHub, release or source variants, or access the correct sites supporting that other software.

@Pysis you are absolutely correct, i didnt realize that until you mentioned it and went to check the github repo that i took the files to compile the first time, i had the CMangos before and now i took the files from here, so its not a downgraded version i just never realized that due to the similarity of the names and the icons of Mangos looked old-school styled when compared to the CMangos so i thats why i thought that. lol