Hi everybody
I just installed cockpit in a server that I have access exclusively with ssh keys, my surprise is that the user hasn't a password and installing cockpit make possible to login without password opening a breach. Having users without password is a problem but if you have ssh set up to enforce key authentication this problem can happen silently, once you install cockpit anyone with access to the servers 9090 port and the user name will gain access to the server.
Again i still think that the cause is the user without password, but would be nice if cockpit enforce password authentication to avoid this, what you guys think?
Regards,
PS: I tested with cockpit 176 from centos 7.6 repos
If is anybody interested in testing for this case, the below command will show if you have users with empty passwords on your server
cut -f1 -d: /etc/passwd | sudo xargs -n1 passwd --status | grep Empty
Em qui, 10 de jan de 2019 às 23:26, Daniel. danielhilst@gmail.com escreveu:
Hi everybody
I just installed cockpit in a server that I have access exclusively with ssh keys, my surprise is that the user hasn't a password and installing cockpit make possible to login without password opening a breach. Having users without password is a problem but if you have ssh set up to enforce key authentication this problem can happen silently, once you install cockpit anyone with access to the servers 9090 port and the user name will gain access to the server.
Again i still think that the cause is the user without password, but would be nice if cockpit enforce password authentication to avoid this, what you guys think?
Regards,
PS: I tested with cockpit 176 from centos 7.6 repos
“If you're going to try, go all the way. Otherwise, don't even start. ..." Charles Bukowski
Hello Daniel,
Daniel. [2019-01-10 23:26 -0200]:
I just installed cockpit in a server that I have access exclusively with ssh keys, my surprise is that the user hasn't a password and installing cockpit make possible to login without password opening a breach.
*Never* have users with an empty password (i. e. no password)! As you see, this will allow anyone else to log into the system as that user, via cockpit or su. Just disabling one avenue of login (e. g. by disabling password authentication in sshd_config) leaves too many other holes open.
Note that cockpit is doing nothing special, /etc/pam.d/cockpit just includes the common "password-auth" PAM module.
The proper way to configure such user accounts is to not have a valid empty password, but a locked one:
sudo passwd --lock thatuser
Martin
Thanks Martin,
I created a password for this my empty password user, I just want to report the possible breach and give everybody a way to fix it. Thanks for sharing the solution, I will add checks for empty passwords in my monitoring tools
Regards,
Em sex, 11 de jan de 2019 às 05:37, Martin Pitt martin@piware.de escreveu:
Hello Daniel,
Daniel. [2019-01-10 23:26 -0200]:
I just installed cockpit in a server that I have access exclusively with ssh keys, my surprise is that the user hasn't a password and installing cockpit make possible to login without password opening a breach.
*Never* have users with an empty password (i. e. no password)! As you see, this will allow anyone else to log into the system as that user, via cockpit or su. Just disabling one avenue of login (e. g. by disabling password authentication in sshd_config) leaves too many other holes open.
Note that cockpit is doing nothing special, /etc/pam.d/cockpit just includes the common "password-auth" PAM module.
The proper way to configure such user accounts is to not have a valid empty password, but a locked one:
sudo passwd --lock thatuser
Martin _______________________________________________ cockpit-devel mailing list -- cockpit-devel@lists.fedorahosted.org To unsubscribe send an email to cockpit-devel-leave@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/cockpit-devel@lists.fedorahoste...
cockpit-devel@lists.fedorahosted.org