[opencms-dev] Security bug (or design flaw) with Account Manager role

[Fabian Huschka]

Hello Alex,

my take on this is that:

a) an Account-Manager may not change any user accounts other than the 
ones from the OU he is a member of
b) he must not change any passwords of a user with the role admin

An admin user should never forget his password, and if he does the pink 
slip is not far around the corner anyway.

In my humble opinion, the risk of self-promoting is less evident than 
the risk of someone learning the account manager´s password.


\Fabian



Alexander Kandzior schrieb:
>> this issue has been resolved in CVS Head 
>>     
>
> Actually this was a different issue. 
>
> The issue described by John exists and can be describes like this: The user
> manager may change the password of an Admin, then using the Admin account
> with the password now known to him to log in as the Admin, thereby
> "promoting" himself.
>
> However, an account manager doing this will lock out the admin and thereby
> making it quite obvious that something "strange" has happend. So this is at
> least an operation that leaves quite a big trail. One could argue that even
> an admin may forget his password, so it could be useful that an account
> manager can reset this.
>
> So the 2 options are:
>
> 1) account managers must never change the password of an admin
> 2) account managers should be able to change the password of an admin
>
> If 1) is the way to go ahead, what about the other data of an admin account?
> Maybe an account manager should not be able to change any data from an admin
> user at all?
>
> I would like some feedback on this issue. Please let me know what you think.
>
> Kind Regards,
> Alex.
>  
> -------------------
> Alexander Kandzior
>
> Alkacon Software GmbH  - The OpenCms Experts                    
> http://www.alkacon.com - http://www.opencms.org                 
>                                                                 
> Visit us on CeBIT expo in Hannover, Germany                      
> March 4 to March 9, 2008 - Hall 5 Stand F59/3                       
>
>   
>> -----Original Message-----
>> From: opencms-dev-bounces at opencms.org 
>> [mailto:opencms-dev-bounces at opencms.org] On Behalf Of Arash 
>> Kaffamanesh
>> Sent: Saturday, February 23, 2008 9:25 AM
>> To: The OpenCms mailing list
>> Subject: Re: [opencms-dev] Security bug (or design flaw) with 
>> Account Manager role
>>
>> hi,
>>
>> this issue has been resolved in CVS Head as Michael Moossen 
>> wrote this 
>> week and will be available in OpenCms 7.0.4 in short.
>> You have to upgrade to Head or wait for OpenCms 7.0.4.
>>
>> Kind Regards,
>> Arash
>>
>>
>> John Weible schrieb:
>>     
>>> As our OpenCms installation grows, we're now needing to 
>>>       
>> delegate more 
>>     
>>> things to a broader set of staff.  One of those things is 
>>>       
>> we need to 
>>     
>>> enable some folks to do basic user management (specifically 
>>> adding/removing users from groups). 
>>>
>>> We're currently on 7.0.1.  So I tried granting the "Account 
>>>       
>> Manager" 
>>     
>>> role to a couple of our NON-ADMINISTRATOR users.  This, as 
>>>       
>> expected, 
>>     
>>> then allows them to add and remove groups for users.  The 
>>>       
>> system also 
>>     
>>> correctly figures out that since they are not themselves "Root 
>>> Administrators", they are disallowed from promoting accounts to be 
>>> Administrators.
>>>
>>> The fatal flaw is that the system does NOT prevent them 
>>>       
>> from changing 
>>     
>>> any Administrator's account password. 
>>>
>>> Is there some different way to configure the system to 
>>>       
>> delegate this 
>>     
>>> ability without introducing such a compromise?
>>>
>>>   
>>>       
>>
>> _______________________________________________
>> This mail is sent to you from the opencms-dev mailing list
>> To change your list options, or to unsubscribe from the list, 
>> please visit
>> http://lists.opencms.org/mailman/listinfo/opencms-dev
>>
>>
>>     
>
>
> _______________________________________________
> This mail is sent to you from the opencms-dev mailing list
> To change your list options, or to unsubscribe from the list, please visit
> http://lists.opencms.org/mailman/listinfo/opencms-dev
>