Project

General

Profile

Actions
Copy link

User story #16620

closed

Add a command to generate user accounts after installation

Added by Alexis Mousset almost 5 years ago. Updated over 4 years ago.

Status:
Released
Priority:
N/A
Assignee:
Benoît PECCATTE
Category:
Security
Target version:
6.1.0~beta1
Pull Request:
https://github.com/Normation/rudder-a...
UX impact:
Suggestion strength:
User visibility:
Getting started - demo | first install | Technique editor and level 1 Techniques
Effort required:
Name check:
To do
Fix check:
Checked
Regression:

Description

We should not open the server with a default password after installation.

It leaves an open window for compromising the server before password change, and we regularly see Rudder servers in the wild with default passwords. It should not be the default behavior.

We should display the password in install output and document how to set it automatically for automated installs.

Subtasks 1 (0 open — 1 closed)

Architecture #17105: Update default rudder-users.xmlReleasedFrançois ARMANDActions

Related issues 2 (0 open — 2 closed)

Related to Rudder - User story #16732: It should be impossible to connect with "admin" password with default configReleasedFrançois ARMANDActions
Related to Rudder - User story #17070: Display a warning in place of login form if no user are definedReleasedRaphael GAUTHIERActions
Actions
Copy link
 #1

Updated by Benoît PECCATTE almost 5 years ago

  • Status changed from New to In progress
  • Assignee set to Benoît PECCATTE
Actions
Copy link
 #2

Updated by Benoît PECCATTE almost 5 years ago

  • Status changed from In progress to New
  • Assignee deleted (Benoît PECCATTE)
Actions
Copy link
 #3

Updated by Alexis Mousset almost 5 years ago

  • Status changed from New to In progress
  • Assignee set to Alexis Mousset
Actions
Copy link
 #4

Updated by Alexis Mousset almost 5 years ago

  • Status changed from In progress to New
  • Assignee deleted (Alexis Mousset)
  • Private changed from Yes to No
Actions
Copy link
 #5

Updated by Alexis Mousset almost 5 years ago

  • Status changed from New to In progress
  • Assignee set to Alexis Mousset
Actions
Copy link
 #6

Updated by Alexis Mousset almost 5 years ago 

passwd=$(dd if=/dev/urandom count=128 bs=1 2>/dev/null | base64 -w0 | cut -b-20)
hash=$(htpasswd -nbBC 12 "" "$passwd" | tr -d ':\n')
Actions
Copy link
 #7

Updated by Vincent MEMBRÉ almost 5 years ago

  • Target version changed from 6.0.3 to 6.0.4
Actions
Copy link
 #8

Updated by Vincent MEMBRÉ over 4 years ago

  • Target version changed from 6.0.4 to 6.0.5
Actions
Copy link
 #9

Updated by Alexis Mousset over 4 years ago

  • Related to User story #16732: It should be impossible to connect with "admin" password with default config added
Actions
Copy link
 #10

Updated by François ARMAND over 4 years ago

  • Related to User story #17070: Display a warning in place of login form if no user are defined added
Actions
Copy link
 #11

Updated by François ARMAND over 4 years ago

  • Priority changed from 122 to 120

Actually, generating password during installation is just too error prone. There is a lot of risks, like password ending in logs, and most likely user won't see/copy/etc it (lost in the middle of log, and even if we successfully make it appears in last position, a lot of people just don't read installation logs).

So, we will do:

- create a command "rudder server init-roor-admin" that only create an admin user with the admin rights and given password (that ticket will do that),
- don't create and admin user in rudder-users.xml file at all during installation. Of course, it doesn't change anything for cases where that file already exists, like for rudder upgrade, and if you want to have predefined user with known password you can just pre-create that file or override it after installation (#16732),
- warn on login page if no user are defined and point to documentation about how to do that (#17070).

We wonder if it would be nice to have a form on fisrt connexion that just let you fill admin login/password, but we are not sure about the idea of letting anybody define a root user if for some reason rudder-users.xml got erased.

Actions
Copy link
 #12

Updated by François ARMAND over 4 years ago

  • Target version changed from 6.0.5 to 6.1.0~beta1
  • Priority changed from 120 to 60
Actions
Copy link
 #13

Updated by François ARMAND over 4 years ago

  • Effort required deleted (Very Small)
  • Priority changed from 60 to 46
Actions
Copy link
 #14

Updated by Alexis Mousset over 4 years ago

  • Subject changed from Generate a random password during installation for admin account to Add a command to generate user accounts after installation
Actions
Copy link
 #15

Updated by Alexis Mousset over 4 years ago

  • Status changed from In progress to Pending technical review
  • Assignee changed from Alexis Mousset to Benoît PECCATTE
  • Pull Request set to https://github.com/Normation/rudder-agent/pull/293
Actions
Copy link
 #16

Updated by Alexis Mousset over 4 years ago

  • Status changed from Pending technical review to Pending release
Actions
Copy link
 #17

Updated by François ARMAND over 4 years ago

  • Tracker changed from Bug to User story
  • Severity deleted (Critical - prevents main use of Rudder | no workaround | data loss | security)
  • Priority deleted (46)
Actions
Copy link
 #18

Updated by Vincent MEMBRÉ over 4 years ago

  • Status changed from Pending release to Released

This bug has been fixed in Rudder 6.1.0~beta1 which was released today.

Actions
Copy link
 #19

Updated by Félix DALLIDET over 4 years ago

  • Fix check changed from To do to Checked
Actions
Copy link

Also available in: Atom PDF