bhyve-webadmin
bhyve-webadmin copied to clipboard
New install locks out admin account when changing password
Issue: admin user gets locked out and IP "blacklisted" after updating admin account credentials Steps to reproduce:
- Login to UI with generated password from the installer (username: admin)
- Edit account details for "Administrator"
- Set mail address to "admin@localhost"
- Set password to a valid/secure alphanumeric + special chars
- Logout, then revisit Login screen
- Enter username + password == Access Denied
- Repeat login, Access Denied. One more time, and the browser's IP gets blacklisted with seemingly no expiration
- Head over to API via CLI/terminal and inspect current admin account
- Reset admin account using API/CLI commands
- Login screen now refuses to display anything except
PR_CONNECT_RESET_ERRORerror - Reset backend service via CLI,
service bvcp-backend restart, insufficient and blacklist still active - Reset frontend + helper services:
service bvcp-frontend restart+service bvcp-helper restart== IP blacklist resolved, password for administrative account is now accepted. Concern regarding password health: no security checks are engaged when changing the user creds via CLI; a purely alpha lower-case no-numerals-no-specials password is accepted via the web-form login.
Secure Connection Failed
An error occurred during a connection to <LAN-IP-HERE>:8086. PR_CONNECT_RESET_ERROR
Error code: PR_CONNECT_RESET_ERROR
BVCP version: 2.1.4 FreeBSD version: 14.0-RELEASE-p6 Browser used: LibreWolf
Thank you for the detailed explanation of this case. Allow me to collect the necessary information to clarify how the user management exactly works, how much time the expiration in case of blacklisting and what could cause the situation above.
Frontend caches for a short period the account information, I think the issue could related to this feature.