Project

General

Profile

Actions
Copy link

Bug #12346

closed
SW JP

Deny SSH access for ``admin`` and ``root`` users when the ``admin`` GUI account is disabled

Bug #12346: Deny SSH access for ``admin`` and ``root`` users when the ``admin`` GUI account is disabled

Added by Steve Wheeler about 5 years ago. Updated over 4 years ago.

Status:
Closed
Priority:
High
Assignee:
Jim Pingle
Category:
Authentication
Target version:
2.6.0
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
22.01
Release Notes:
Default
Affected Version:
2.5.2
Affected Architecture:
All

Description

If the admin user is disabled in the webgui that user can still login via SSH if it's enabled as long as they have either the admins group or 'User - System: Shell account access' privilege.

Both of those are set by default.

This includes via SSH key if configured.

In this condition the admin user cannot login to the webgui.

Other user accounts cannot login via SSH when they are disabled.

The webgui does not display a warning if the admin credentials are still default if the account is disabled.

Tested:
2.5.2-rel
21.05.1-rel

21.09-BETA (arm)
built on Tue Sep 07 01:12:17 EDT 2021
FreeBSD 12.2-STABLE

JP Updated by Jim Pingle about 5 years ago Actions
Copy link
 #1

  • Status changed from New to In Progress
  • Assignee set to Jim Pingle

I could swear there was already a redmine issue for this but I'm not seeing it now.

We can't actually completely disable admin as it's tied to root and disabling root would break things. That said, we could cut off ssh access at least.

In source:src/etc/sshd#L88 we set PermitRootLogin to yes unconditionally, but if we wrapped that in a check if the admin user was disabled and set it to no if admin is disabled, it should prevent both root and admin from hitting SSH without affecting console access or other functions.

JP Updated by Jim Pingle about 5 years ago Actions
Copy link
 #2

  • Status changed from In Progress to Feedback
  • % Done changed from 0 to 100

Applied in changeset commit:5d0c974dd7e369cb551aacb5f4587e400141cb7a.

JG Updated by Jordan G about 5 years ago Actions
Copy link
 #3

tested on XG-7100 running 21.09.b.20210911.0100

was unable to ssh as admin following disabling admin from GUI user manager

JP Updated by Jim Pingle about 5 years ago Actions
Copy link
 #4

  • Status changed from Feedback to Closed

JP Updated by Jim Pingle about 5 years ago Actions
Copy link
 #5

  • Subject changed from Disabled admin user can still login via SSH to Deny SSH access for ``admin`` and ``root`` users when the ``admin`` GUI account is disabled

Updating subject for release notes

JP Updated by Jim Pingle almost 5 years ago Actions
Copy link
 #6

  • Plus Target Version changed from 21.09 to 22.01

JP Updated by Jim Pingle over 4 years ago Actions
Copy link
 #7

  • Private changed from Yes to No
Actions
Copy link

Also available in: Atom