Topic: Major security hole found in web admin in beta 3

[Try2Break]

I have installed 4.1 beta 3, replaceing a 4.0 server w/ SSL and SSH installed.  When I would admin my box under 4.0 I would use SSL so people couldn't sniff my password.  Now with the change of the e-smith-manager in beta 3 it runs a seperate web server on port 980 without SSL.  While I can see where the depelopers are going with this, you can't securely administer it now (aside from using the text browser on the console over SSH).  Is this going to be fixed before 4.1 final?  The only reason I want SSL is for admin and webmail.  Now that webmail works, admin doesn't.

[Jason Miller]

>I have installed 4.1 beta 3, replaceing a 4.0 server w/ SSL and >SSH installed.  When I would admin my box under 4.0 I would use >SSL so people couldn't sniff my password.  Now with the change >of the e-smith-manager in beta 3 it runs a seperate web server >on port 980 without SSL.  While I can see where the depelopers >are going with this, you can't securely administer it now (aside >from using the text browser on the console over SSH).  Is this >going to be fixed before 4.1 final?  The only reason I want SSL >is for admin and webmail.  Now that webmail works, admin >doesn't.

Mod-ssl for the manager was dropped as one of the features we had hoped to put into 4.1 final.

That being said, you can still administer the box remotely and securely as ssh is now installed (and turned off by default - changed through the webmanager on remote connections).  You can either choose to run lynx from that ssh session or you can port forward the manager.  Both work equally well and the Mod-ssl for the manager will be there in the future.

Also, please do not report problems/questions regarding the beta releases in the forum.  We need those sorts of reports to go on the developers mailing list (http://www.e-smith.org/developers) so that we can keep track of all problems we encounter as we work towards 4.1 final.

Thanks for your report.

Jason

[Justin]

I am going to have to "agree to disagree" here. This scenario only poses a significant threat to your own internal users sniffing on the local network.

If you have users sniffing on your LAN then remote administration is not a good idea - period. I would limit all administration to the console only or explicity allow only your machine to access the e-smith-manager server using other authentication methods.

If you are remotely administering the servers across a public network without a VPN then this is an implementation issue not a e-smith server issue.

I would joing the developer mailing list - there is some excellent discussion on VPN's and remote administration happening right now.