Project

General

Profile

Actions

Bug #12346

closed

Deny SSH access for ``admin`` and ``root`` users when the ``admin`` GUI account is disabled

Added by Steve Wheeler over 2 years ago. Updated about 2 years ago.

Status:
Closed
Priority:
High
Assignee:
Category:
Authentication
Target version:
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
22.01
Release Notes:
Default
Affected Version:
2.5.2
Affected Architecture:
All

Description

If the admin user is disabled in the webgui that user can still login via SSH if it's enabled as long as they have either the admins group or 'User - System: Shell account access' privilege.

Both of those are set by default.

This includes via SSH key if configured.

In this condition the admin user cannot login to the webgui.

Other user accounts cannot login via SSH when they are disabled.

The webgui does not display a warning if the admin credentials are still default if the account is disabled.

Tested:
2.5.2-rel
21.05.1-rel

21.09-BETA (arm)
built on Tue Sep 07 01:12:17 EDT 2021
FreeBSD 12.2-STABLE

Actions #1

Updated by Jim Pingle over 2 years ago

  • Status changed from New to In Progress
  • Assignee set to Jim Pingle

I could swear there was already a redmine issue for this but I'm not seeing it now.

We can't actually completely disable admin as it's tied to root and disabling root would break things. That said, we could cut off ssh access at least.

In source:src/etc/sshd#L88 we set PermitRootLogin to yes unconditionally, but if we wrapped that in a check if the admin user was disabled and set it to no if admin is disabled, it should prevent both root and admin from hitting SSH without affecting console access or other functions.

Actions #2

Updated by Jim Pingle over 2 years ago

  • Status changed from In Progress to Feedback
  • % Done changed from 0 to 100
Actions #3

Updated by Jordan G over 2 years ago

tested on XG-7100 running 21.09.b.20210911.0100

was unable to ssh as admin following disabling admin from GUI user manager

Actions #4

Updated by Jim Pingle over 2 years ago

  • Status changed from Feedback to Closed
Actions #5

Updated by Jim Pingle over 2 years ago

  • Subject changed from Disabled admin user can still login via SSH to Deny SSH access for ``admin`` and ``root`` users when the ``admin`` GUI account is disabled

Updating subject for release notes

Actions #6

Updated by Jim Pingle over 2 years ago

  • Plus Target Version changed from 21.09 to 22.01
Actions #7

Updated by Jim Pingle about 2 years ago

  • Private changed from Yes to No
Actions

Also available in: Atom PDF