bhyve-webadmin icon indicating copy to clipboard operation
bhyve-webadmin copied to clipboard

New install locks out admin account when changing password

Open em-winterschon opened this issue 1 year ago • 1 comments

Issue: admin user gets locked out and IP "blacklisted" after updating admin account credentials Steps to reproduce:

  1. Login to UI with generated password from the installer (username: admin)
  2. Edit account details for "Administrator"
  3. Set mail address to "admin@localhost"
  4. Set password to a valid/secure alphanumeric + special chars
  5. Logout, then revisit Login screen
  6. Enter username + password == Access Denied
  7. Repeat login, Access Denied. One more time, and the browser's IP gets blacklisted with seemingly no expiration
  8. Head over to API via CLI/terminal and inspect current admin account
  9. Reset admin account using API/CLI commands
  10. Login screen now refuses to display anything except PR_CONNECT_RESET_ERROR error
  11. Reset backend service via CLI, service bvcp-backend restart, insufficient and blacklist still active
  12. Reset frontend + helper services: service bvcp-frontend restart + service bvcp-helper restart == IP blacklist resolved, password for administrative account is now accepted. Concern regarding password health: no security checks are engaged when changing the user creds via CLI; a purely alpha lower-case no-numerals-no-specials password is accepted via the web-form login.
Secure Connection Failed
An error occurred during a connection to <LAN-IP-HERE>:8086. PR_CONNECT_RESET_ERROR
Error code: PR_CONNECT_RESET_ERROR

BVCP version: 2.1.4 FreeBSD version: 14.0-RELEASE-p6 Browser used: LibreWolf

em-winterschon avatar Apr 09 '24 23:04 em-winterschon

Thank you for the detailed explanation of this case. Allow me to collect the necessary information to clarify how the user management exactly works, how much time the expiration in case of blacklisting and what could cause the situation above.

Frontend caches for a short period the account information, I think the issue could related to this feature.

DaVieS007 avatar Apr 11 '24 18:04 DaVieS007