Harden what a built image leaves in its accounts and in the Webmin authentication path #11

New issue

Closed

opened 2026-09-28 05:30:25 -03:00 by marcos-mendez · 0 comments

marcos-mendez commented

2026-09-28 05:30:25 -03:00

(Migrated from github.com)

A built appliance carries accounts before its first boot has set any
password on them, and two of the things the build leaves behind are more
permissive than they need to be:

conf/turnkey.d/rootpass, when the build is given no ROOT_PASS, writes
a password field into the root account that a submitted password can
match, rather than one that nothing matches until the first boot sets a
real password over it.
the PAM stack the webmin package installs carries nullok, which lets
an account whose password is not set be authenticated without one.
Nothing in an appliance asks for that option.

And the web interface starts with the rest of the boot, before the first
boot scripts that configure the appliance have run at all.

Wanted, as ordinary hardening of the build:

a placeholder in the password field that no password matches, chosen so
that the first boot still works: passwd --unlock root, which
turnkey-sudoadmin runs on every first boot, must still succeed over it;
nullok out of the webmin PAM stack;
Webmin held back until the first boot scripts have run;
tests that assert the behaviour, including the state of an image after
the conf scripts have run and before the first boot has completed.

Filed against the private handbook issue Keel-Linux/handbook#14, which
carries the detail.

A built appliance carries accounts before its first boot has set any password on them, and two of the things the build leaves behind are more permissive than they need to be: - `conf/turnkey.d/rootpass`, when the build is given no `ROOT_PASS`, writes a password field into the root account that a submitted password can match, rather than one that nothing matches until the first boot sets a real password over it. - the PAM stack the `webmin` package installs carries `nullok`, which lets an account whose password is not set be authenticated without one. Nothing in an appliance asks for that option. And the web interface starts with the rest of the boot, before the first boot scripts that configure the appliance have run at all. Wanted, as ordinary hardening of the build: - a placeholder in the password field that no password matches, chosen so that the first boot still works: `passwd --unlock root`, which `turnkey-sudoadmin` runs on every first boot, must still succeed over it; - `nullok` out of the webmin PAM stack; - Webmin held back until the first boot scripts have run; - tests that assert the behaviour, including the state of an image after the conf scripts have run and before the first boot has completed. Filed against the private handbook issue Keel-Linux/handbook#14, which carries the detail.