User story #16620: Add a command to generate user accounts after installation - Rudder - Issue Tracker

Custom queries

8.1 beta
Bugs triage
CS - by priority
CS - to review
My TR
Need technical review
Open bugs (all)
Open bugs (UI - UX)
Open UX defects (all)
Opened by users

Actions

Copy link

User story #16620

closed

Add a command to generate user accounts after installation

Added by Alexis Mousset almost 5 years ago. Updated over 4 years ago.

Status:

Released

Priority:

N/A

Assignee:

Benoît PECCATTE

Category:

Security

Target version:

6.1.0~beta1

Pull Request:

https://github.com/Normation/rudder-a...

UX impact:

Suggestion strength:

User visibility:

Getting started - demo | first install | Technique editor and level 1 Techniques

Effort required:

Name check:

To do

Fix check:

Checked

Regression:

Description

We should not open the server with a default password after installation.

It leaves an open window for compromising the server before password change, and we regularly see Rudder servers in the wild with default passwords. It should not be the default behavior.

We should display the password in install output and document how to set it automatically for automated installs.

Subtasks 1 (0 open — 1 closed)

Architecture #17105: Update default rudder-users.xml

Released

François ARMAND

Actions

Related issues 2 (0 open — 2 closed)

	Related to Rudder - User story #16732: It should be impossible to connect with "admin" password with default config	Released	François ARMAND				Actions
	Related to Rudder - User story #17070: Display a warning in place of login form if no user are defined	Released	Raphael GAUTHIER				Actions

Issue # Delay: days Cancel

History
Notes
Property changes
Associated revisions

Actions

Copy link

Updated by Benoît PECCATTE almost 5 years ago

Status changed from New to In progress
Assignee set to Benoît PECCATTE

Actions

Copy link

Updated by Benoît PECCATTE almost 5 years ago

Status changed from In progress to New
Assignee deleted (~~Benoît PECCATTE~~)

Actions

Copy link

Updated by Alexis Mousset almost 5 years ago

Status changed from New to In progress
Assignee set to Alexis Mousset

Actions

Copy link

Updated by Alexis Mousset almost 5 years ago

Status changed from In progress to New
Assignee deleted (~~Alexis Mousset~~)
Private changed from Yes to No

Actions

Copy link

Updated by Alexis Mousset almost 5 years ago

Status changed from New to In progress
Assignee set to Alexis Mousset

Actions

Copy link

Updated by Alexis Mousset almost 5 years ago

passwd=$(dd if=/dev/urandom count=128 bs=1 2>/dev/null | base64 -w0 | cut -b-20)
hash=$(htpasswd -nbBC 12 "" "$passwd" | tr -d ':\n')

Actions

Copy link

Updated by Vincent MEMBRÉ almost 5 years ago

Target version changed from 6.0.3 to 6.0.4

Actions

Copy link

Updated by Vincent MEMBRÉ over 4 years ago

Target version changed from 6.0.4 to 6.0.5

Actions

Copy link

Updated by Alexis Mousset over 4 years ago

Related to User story #16732: It should be impossible to connect with "admin" password with default config added

Actions

Copy link

#10

Updated by François ARMAND over 4 years ago

Related to User story #17070: Display a warning in place of login form if no user are defined added

Actions

Copy link

#11

Updated by François ARMAND over 4 years ago

Priority changed from 122 to 120

Actually, generating password during installation is just too error prone. There is a lot of risks, like password ending in logs, and most likely user won't see/copy/etc it (lost in the middle of log, and even if we successfully make it appears in last position, a lot of people just don't read installation logs).

So, we will do:

- create a command "rudder server init-roor-admin" that only create an admin user with the admin rights and given password (that ticket will do that),
- don't create and admin user in rudder-users.xml file at all during installation. Of course, it doesn't change anything for cases where that file already exists, like for rudder upgrade, and if you want to have predefined user with known password you can just pre-create that file or override it after installation (#16732),
- warn on login page if no user are defined and point to documentation about how to do that (#17070).

We wonder if it would be nice to have a form on fisrt connexion that just let you fill admin login/password, but we are not sure about the idea of letting anybody define a root user if for some reason rudder-users.xml got erased.

Actions

Copy link

#12

Updated by François ARMAND over 4 years ago

Target version changed from 6.0.5 to 6.1.0~beta1
Priority changed from 120 to 60

Actions

Copy link

#13

Updated by François ARMAND over 4 years ago

Effort required deleted (~~Very Small~~)
Priority changed from 60 to 46

Actions

Copy link

#14

Updated by Alexis Mousset over 4 years ago

Subject changed from Generate a random password during installation for admin account to Add a command to generate user accounts after installation

Actions

Copy link

#15

Updated by Alexis Mousset over 4 years ago

Status changed from In progress to Pending technical review
Assignee changed from Alexis Mousset to Benoît PECCATTE
Pull Request set to https://github.com/Normation/rudder-agent/pull/293

PR https://github.com/Normation/rudder-agent/pull/293

Actions

Copy link

#16

Updated by Alexis Mousset over 4 years ago

Status changed from Pending technical review to Pending release

Applied in changeset rudder-agent|c0ef3fbe5bd76b31ee8076c973f3ff40f43143f3.

Actions

Copy link

#17

Updated by François ARMAND over 4 years ago

Tracker changed from Bug to User story
Severity deleted (~~Critical - prevents main use of Rudder | no workaround | data loss | security~~)
Priority deleted (46)

Actions

Copy link

#18

Updated by Vincent MEMBRÉ over 4 years ago

Status changed from Pending release to Released

This bug has been fixed in Rudder 6.1.0~beta1 which was released today.

6.1.0~beta1 changelog
Upgrade manual

Actions

Copy link

#19

Updated by Félix DALLIDET over 4 years ago

Fix check changed from To do to Checked

Actions

Copy link

Also available in: Atom PDF

Project

General

Profile

Rudder

Custom queries

User story #16620

Add a command to generate user accounts after installation

Updated by Benoît PECCATTE almost 5 years ago

Updated by Benoît PECCATTE almost 5 years ago

Updated by Alexis Mousset almost 5 years ago

Updated by Alexis Mousset almost 5 years ago

Updated by Alexis Mousset almost 5 years ago

Updated by Alexis Mousset almost 5 years ago

Updated by Vincent MEMBRÉ almost 5 years ago

Updated by Vincent MEMBRÉ over 4 years ago

Updated by Alexis Mousset over 4 years ago

Updated by François ARMAND over 4 years ago

Updated by François ARMAND over 4 years ago

Updated by François ARMAND over 4 years ago

Updated by François ARMAND over 4 years ago

Updated by Alexis Mousset over 4 years ago

Updated by Alexis Mousset over 4 years ago

Updated by Alexis Mousset over 4 years ago

Updated by François ARMAND over 4 years ago

Updated by Vincent MEMBRÉ over 4 years ago

Updated by Félix DALLIDET over 4 years ago