Commit 93397f8a authored by Franco Fichtner's avatar Franco Fichtner

auth: replace spurious admin user in favour of root

A hybrid approach was previously employed that made it possible
to use admin as a synonym for root, which was really confusing
and a bit unclear judging by the actual code employed.  Does
admin own a home directory or not?  Why does root work on the
console, but not in the web interface?
parent ee873727
...@@ -172,7 +172,7 @@ ...@@ -172,7 +172,7 @@
<priv>page-all</priv> <priv>page-all</priv>
</group> </group>
<user> <user>
<name>admin</name> <name>root</name>
<descr><![CDATA[System Administrator]]></descr> <descr><![CDATA[System Administrator]]></descr>
<scope>system</scope> <scope>system</scope>
<groupname>admins</groupname> <groupname>admins</groupname>
......
<?php <?php
/* $Id$ */
/*
Copyright (C) 2010 Ermal Lu�i
All rights reserved.
/*
Copyright (C) 2014 Deciso B.V.
Copyright (C) 2010 Ermal Luçi
Copyright (C) 2007, 2008 Scott Ullrich <sullrich@gmail.com> Copyright (C) 2007, 2008 Scott Ullrich <sullrich@gmail.com>
All rights reserved.
Copyright (C) 2005-2006 Bill Marquette <bill.marquette@gmail.com> Copyright (C) 2005-2006 Bill Marquette <bill.marquette@gmail.com>
All rights reserved.
Copyright (C) 2006 Paul Taylor <paultaylor@winn-dixie.com>. Copyright (C) 2006 Paul Taylor <paultaylor@winn-dixie.com>.
All rights reserved.
Copyright (C) 2003-2006 Manuel Kasper <mk@neon1.net>. Copyright (C) 2003-2006 Manuel Kasper <mk@neon1.net>.
All rights reserved. All rights reserved.
...@@ -36,10 +29,6 @@ ...@@ -36,10 +29,6 @@
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE. POSSIBILITY OF SUCH DAMAGE.
DISABLE_PHP_LINT_CHECKING
pfSense_BUILDER_BINARIES: /usr/sbin/pw /bin/cp
pfSense_MODULE: auth
*/ */
/* /*
...@@ -311,25 +300,26 @@ function local_backed($username, $passwd) { ...@@ -311,25 +300,26 @@ function local_backed($username, $passwd) {
return false; return false;
} }
function local_sync_accounts() { function local_sync_accounts()
global $debug, $config; {
global $config;
conf_mount_rw(); conf_mount_rw();
/* remove local users to avoid uid conflicts */ /* remove local users to avoid uid conflicts */
$fd = popen("/usr/sbin/pw usershow -a", "r"); $fd = popen('/usr/sbin/pw usershow -a', 'r');
if ($fd) { if ($fd) {
while (!feof($fd)) { while (!feof($fd)) {
$line = explode(":",fgets($fd)); $line = explode(':',fgets($fd));
if (((!strncmp($line[0], "_", 1)) || ($line[2] < 2000) || ($line[2] > 65000)) && ($line[0] != "admin")) if (((!strncmp($line[0], '_', 1)) || ($line[2] < 2000) || ($line[2] > 65000))) {
continue; continue;
}
/* /*
* If a crontab was created to user, pw userdel will be interactive and * If a crontab was created to user, pw userdel will be interactive and
* can cause issues. Just remove crontab before run it when necessary * can cause issues. Just remove crontab before run it when necessary
*/ */
unlink_if_exists("/var/cron/tabs/{$line[0]}"); unlink_if_exists("/var/cron/tabs/{$line[0]}");
$cmd = "/usr/sbin/pw userdel -n '{$line[0]}'"; $cmd = "/usr/sbin/pw userdel -n '{$line[0]}'";
if($debug)
log_error(sprintf(gettext("Running: %s"), $cmd));
mwexec($cmd); mwexec($cmd);
} }
pclose($fd); pclose($fd);
...@@ -337,19 +327,20 @@ function local_sync_accounts() { ...@@ -337,19 +327,20 @@ function local_sync_accounts() {
/* remove local groups to avoid gid conflicts */ /* remove local groups to avoid gid conflicts */
$gids = array(); $gids = array();
$fd = popen("/usr/sbin/pw groupshow -a", "r"); $fd = popen('/usr/sbin/pw groupshow -a', 'r');
if ($fd) { if ($fd) {
while (!feof($fd)) { while (!feof($fd)) {
$line = explode(":",fgets($fd)); $line = explode(':',fgets($fd));
if (!strncmp($line[0], "_", 1)) if (!strncmp($line[0], '_', 1)) {
continue; continue;
if ($line[2] < 2000) }
if ($line[2] < 2000) {
continue; continue;
if ($line[2] > 65000) }
if ($line[2] > 65000) {
continue; continue;
}
$cmd = "/usr/sbin/pw groupdel {$line[2]}"; $cmd = "/usr/sbin/pw groupdel {$line[2]}";
if($debug)
log_error(sprintf(gettext("Running: %s"), $cmd));
mwexec($cmd); mwexec($cmd);
} }
pclose($fd); pclose($fd);
...@@ -410,7 +401,7 @@ function local_user_set(& $user) { ...@@ -410,7 +401,7 @@ function local_user_set(& $user) {
$lock_account = true; $lock_account = true;
} }
/* Lock out disabled or expired users, unless it's root/admin. */ /* Lock out disabled or expired users, unless it's root */
if ((is_account_disabled($user_name) || is_account_expired($user_name)) && ($user_uid != 0)) { if ((is_account_disabled($user_name) || is_account_expired($user_name)) && ($user_uid != 0)) {
$user_shell = "/sbin/nologin"; $user_shell = "/sbin/nologin";
$lock_account = true; $lock_account = true;
...@@ -480,16 +471,11 @@ function local_user_set(& $user) { ...@@ -480,16 +471,11 @@ function local_user_set(& $user) {
conf_mount_ro(); conf_mount_ro();
} }
function local_user_del($user) { function local_user_del($user)
global $debug; {
/* remove all memberships */ /* remove all memberships */
local_user_set_groups($user); local_user_set_groups($user);
/* Don't remove /root */
if ($user['uid'] != 0)
$rmhome = "-r";
/* read from pw db */ /* read from pw db */
$fd = popen("/usr/sbin/pw usershow -n {$user['name']} 2>&1", "r"); $fd = popen("/usr/sbin/pw usershow -n {$user['name']} 2>&1", "r");
$pwread = fgets($fd); $pwread = fgets($fd);
...@@ -502,10 +488,8 @@ function local_user_del($user) { ...@@ -502,10 +488,8 @@ function local_user_del($user) {
} }
/* delete from pw db */ /* delete from pw db */
$cmd = "/usr/sbin/pw userdel -n {$user['name']} {$rmhome}"; $cmd = "/usr/sbin/pw userdel -n {$user['name']} -r";
if($debug)
log_error(sprintf(gettext("Running: %s"), $cmd));
mwexec($cmd); mwexec($cmd);
/* Delete user from groups needs a call to write_config() */ /* Delete user from groups needs a call to write_config() */
......
...@@ -490,13 +490,15 @@ function safe_write_file($file, $content, $force_binary) { ...@@ -490,13 +490,15 @@ function safe_write_file($file, $content, $force_binary) {
* null * null
******/ ******/
/* save the system configuration */ /* save the system configuration */
function write_config($desc="Unknown", $backup = true) { function write_config($desc = 'Unknown', $backup = true)
{
global $config, $g; global $config, $g;
if (!empty($_SERVER['REMOTE_ADDR'])) { if (!empty($_SERVER['REMOTE_ADDR'])) {
if (!session_id()) if (!session_id()) {
@session_start(); @session_start();
if (!empty($_SESSION['Username']) && ($_SESSION['Username'] != "admin")) { }
if (!empty($_SESSION['Username']) && ($_SESSION['Username'] != 'root')) {
$user = getUserEntry($_SESSION['Username']); $user = getUserEntry($_SESSION['Username']);
if (is_array($user) && userHasPrivilege($user, "user-config-readonly")) { if (is_array($user) && userHasPrivilege($user, "user-config-readonly")) {
session_commit(); session_commit();
...@@ -505,11 +507,13 @@ function write_config($desc="Unknown", $backup = true) { ...@@ -505,11 +507,13 @@ function write_config($desc="Unknown", $backup = true) {
} }
} }
if (!isset($argc)) if (!isset($argc)) {
session_commit(); session_commit();
}
if($backup) if ($backup) {
backup_config(); backup_config();
}
$config['revision'] = make_config_revision_entry($desc); $config['revision'] = make_config_revision_entry($desc);
......
...@@ -35,7 +35,7 @@ register_shutdown_function('closelog'); ...@@ -35,7 +35,7 @@ register_shutdown_function('closelog');
$g = array( $g = array(
"base_packages" => "siproxd", "base_packages" => "siproxd",
"event_address" => "unix:///var/run/check_reload_status", "event_address" => "unix:///var/run/check_reload_status",
"factory_shipped_username" => "admin", "factory_shipped_username" => "root",
"factory_shipped_password" => "opnsense", "factory_shipped_password" => "opnsense",
"upload_path" => "/root", "upload_path" => "/root",
"dhcpd_chroot_path" => "/var/dhcpd", "dhcpd_chroot_path" => "/var/dhcpd",
......
...@@ -179,42 +179,51 @@ function get_user_privdesc(& $user) { ...@@ -179,42 +179,51 @@ function get_user_privdesc(& $user) {
return $privs; return $privs;
} }
function isAllowed($username, $page) { function isAllowed($username, $page)
{
global $_SESSION; global $_SESSION;
if (!isset($username)) if (!isset($username)) {
return false; return false;
}
/* admin/root access check */ /* root access check */
$user = getUserEntry($username); $user = getUserEntry($username);
if (isset($user)) if (isset($user)) {
if (isset($user['uid'])) if (isset($user['uid'])) {
if ($user['uid']==0) if ($user['uid'] == 0) {
return true; return true;
}
}
}
/* user privelege access check */ /* user privelege access check */
if (cmp_page_matches($page, $_SESSION['page-match'])) if (cmp_page_matches($page, $_SESSION['page-match'])) {
return true; return true;
}
return false; return false;
} }
function isAllowedPage($page)
function isAllowedPage($page) { {
global $_SESSION; global $_SESSION;
$username = $_SESSION['Username']; $username = $_SESSION['Username'];
if (!isset($username)) if (!isset($username)) {
return false; return false;
}
/* admin/root access check */ /* root access check */
$user = getUserEntry($username); $user = getUserEntry($username);
if (isset($user)) if (isset($user)) {
if (isset($user['uid'])) if (isset($user['uid'])) {
if ($user['uid']==0) if ($user['uid'] == 0) {
return true; return true;
}
}
}
/* user privelege access check */ /* user privelege access check */
return cmp_page_matches($page, $_SESSION['page-match']); return cmp_page_matches($page, $_SESSION['page-match']);
......
...@@ -62,8 +62,8 @@ The User manager authentication server is set to "' . $config['system']['webgui' ...@@ -62,8 +62,8 @@ The User manager authentication server is set to "' . $config['system']['webgui'
} }
$admin_user['name'] = $g['factory_shipped_username']; $admin_user['name'] = $g['factory_shipped_username'];
$admin_user['priv'] = array("user-shell-access"); $admin_user['priv'] = array('user-shell-access');
$admin_user['scope'] = "system"; $admin_user['scope'] = 'system';
if (isset($admin_user['disabled'])) { if (isset($admin_user['disabled'])) {
unset($admin_user['disabled']); unset($admin_user['disabled']);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment