User Panel login at 2083 error 'Failed'

You may have already found this fix but, it has taken me a few years to figure it out so, I thought I would share. Yes, I didn't do alone. Grok actually helped me get there.

Highest-probability fix for CentOS Stream / Alma / Rocky 9
Run these exact commands:

Code: [Select]

# 1. Comment out the SHA rounds limit
sed -i 's/^SHA_CRYPT_MAX_ROUNDS/#SHA_CRYPT_MAX_ROUNDS/' /etc/login.defs

# Verify it is commented
grep SHA_CRYPT /etc/login.defsYou should now see a line starting with #SHA_CRYPT_MAX_ROUNDS.

Then reset every user’s password from the CWP admin panel (User Accounts → edit each account → set a new password → Save).

Just changing the password in the panel is required after the /etc/login.defs change — the old hashes are incompatible.
After resetting passwords, try logging into a user panel again on port 2083.

Here’s exactly what those two commands did and why they fixed the user-panel logins on CentOS Stream 9.
1. The problem on EL9 (CentOS Stream 9 / AlmaLinux 9 / Rocky 9)
Modern RHEL-based systems (EL9) ship with a high value for password hashing rounds in /etc/login.defs:
BashSHA_CRYPT_MAX_ROUNDS 100000
This tells the system to use a very large number of rounds when creating SHA-512 password hashes (the format used by passwd, chpasswd, and CWP when it sets a user’s password).
CWP’s user-panel authentication code was written (and compiled) against the older, lower-round hashing behaviour that was standard on CentOS 7 / EL8. When the number of rounds is extremely high:

The password hash that CWP stores (or expects) no longer matches the hash the system generates.
Admin-panel login still works because it uses a different authentication path (root credentials / different code).
Every normal user account fails with a generic “Failed” message.

2. What the commands actually did
Bashsed -i 's/^SHA_CRYPT_MAX_ROUNDS/#SHA_CRYPT_MAX_ROUNDS/' /etc/login.defs

sed -i = edit the file in place.
s/^SHA_CRYPT_MAX_ROUNDS/#SHA_CRYPT_MAX_ROUNDS/ = find any line that starts with SHA_CRYPT_MAX_ROUNDS and put a # in front of it.
Result: the line becomes a comment:Bash#SHA_CRYPT_MAX_ROUNDS 100000

Once the line is commented out, the system falls back to the default (much lower) number of rounds that CWP expects.
Bashgrep SHA_CRYPT /etc/login.defs
This simply showed you the current state so you could confirm the line was now commented.
3. Why you still had to reset the passwords
Existing password hashes in /etc/shadow (and in CWP’s internal records) were already created with the high-round setting. Changing /etc/login.defs only affects new hashes.
When you went into the CWP admin panel and set a new password for each user, CWP re-hashed the password using the now-correct (lower-round) method. After that, the user-panel login code could verify the password successfully.

Summary

You disabled the overly aggressive SHA-512 rounds that EL9 enables by default. That made the password hashes CWP creates compatible with the authentication logic used by the user panel on port 2083.
This is a well-known workaround on all EL9-based CWP installations. The permanent long-term fix would be for CWP to update its password-handling code to support the higher round counts, but the /etc/login.defs change is the standard and reliable solution for now.