[opencms-dev] Security bug (or design flaw) with Account Manager role

[Alexander Kandzior]

> this issue has been resolved in CVS Head 

Actually this was a different issue. 

The issue described by John exists and can be describes like this: The user
manager may change the password of an Admin, then using the Admin account
with the password now known to him to log in as the Admin, thereby
"promoting" himself.

However, an account manager doing this will lock out the admin and thereby
making it quite obvious that something "strange" has happend. So this is at
least an operation that leaves quite a big trail. One could argue that even
an admin may forget his password, so it could be useful that an account
manager can reset this.

So the 2 options are:

1) account managers must never change the password of an admin
2) account managers should be able to change the password of an admin

If 1) is the way to go ahead, what about the other data of an admin account?
Maybe an account manager should not be able to change any data from an admin
user at all?

I would like some feedback on this issue. Please let me know what you think.

Kind Regards,
Alex.
 
-------------------
Alexander Kandzior

Alkacon Software GmbH  - The OpenCms Experts                    
http://www.alkacon.com - http://www.opencms.org                 
                                                                
Visit us on CeBIT expo in Hannover, Germany                      
March 4 to March 9, 2008 - Hall 5 Stand F59/3                       

> -----Original Message-----
> From: opencms-dev-bounces at opencms.org 
> [mailto:opencms-dev-bounces at opencms.org] On Behalf Of Arash 
> Kaffamanesh
> Sent: Saturday, February 23, 2008 9:25 AM
> To: The OpenCms mailing list
> Subject: Re: [opencms-dev] Security bug (or design flaw) with 
> Account Manager role
> 
> hi,
> 
> this issue has been resolved in CVS Head as Michael Moossen 
> wrote this 
> week and will be available in OpenCms 7.0.4 in short.
> You have to upgrade to Head or wait for OpenCms 7.0.4.
> 
> Kind Regards,
> Arash
> 
> 
> John Weible schrieb:
> > As our OpenCms installation grows, we're now needing to 
> delegate more 
> > things to a broader set of staff.  One of those things is 
> we need to 
> > enable some folks to do basic user management (specifically 
> > adding/removing users from groups). 
> >
> > We're currently on 7.0.1.  So I tried granting the "Account 
> Manager" 
> > role to a couple of our NON-ADMINISTRATOR users.  This, as 
> expected, 
> > then allows them to add and remove groups for users.  The 
> system also 
> > correctly figures out that since they are not themselves "Root 
> > Administrators", they are disallowed from promoting accounts to be 
> > Administrators.
> >
> > The fatal flaw is that the system does NOT prevent them 
> from changing 
> > any Administrator's account password. 
> >
> > Is there some different way to configure the system to 
> delegate this 
> > ability without introducing such a compromise?
> >
> >   
> 
> 
> 
> _______________________________________________
> This mail is sent to you from the opencms-dev mailing list
> To change your list options, or to unsubscribe from the list, 
> please visit
> http://lists.opencms.org/mailman/listinfo/opencms-dev
> 
>