From 4308aa5415c0c2aadbada8ac083c71cfb0001d1b Mon Sep 17 00:00:00 2001 From: Michael Peter Christen Date: Wed, 25 Oct 2023 22:56:06 +0200 Subject: [PATCH] removed concept of empty passwords as "no passwords used", because we now start YaCy with a default password (yacy). This has impact of all function that check the current state of password-protection that included the empty password situation, including the warnings to set a password in case that none is set (which cannot be the case any more). --- htroot/ConfigAccounts_p.html | 37 ++++++++++--------- htroot/Status_p.inc | 31 +++++++--------- source/net/yacy/data/TransactionManager.java | 10 ++--- source/net/yacy/htroot/ConfigAccounts_p.java | 7 ++-- source/net/yacy/htroot/Status.java | 12 ++---- source/net/yacy/http/YaCySecurityHandler.java | 5 +-- source/net/yacy/search/Switchboard.java | 26 ++----------- 7 files changed, 49 insertions(+), 79 deletions(-) diff --git a/htroot/ConfigAccounts_p.html b/htroot/ConfigAccounts_p.html index f248c5491..c16e5db50 100644 --- a/htroot/ConfigAccounts_p.html +++ b/htroot/ConfigAccounts_p.html @@ -8,7 +8,7 @@ #%env/templates/header.template%# #%env/templates/submenuUseCaseAccount.template%#

User Administration

- + #(text)# :: @@ -26,23 +26,28 @@ ::

Username already used (not allowed).

#(/error)# - #(passwordNotSetWarning)#::
No password is set for the administration account. Please define a password for the admin account.
#(/passwordNotSetWarning)# + #(changedfltpw)#:: + + #(/changedfltpw)#
Admin Account
- +
Access to your peer from your own computer (localhost access) is granted with administrator rights. No need to configure an administration account. - +
- +
@@ -62,22 +67,22 @@
- +
Access Rules
- +
Protection of all pages: if set to on, access to all pages need authorization; if off, only pages with "_p" extension are protected.
-
+
- +
User Accounts
@@ -98,7 +103,7 @@
- +
Edit current user: #[username]# @@ -118,11 +123,9 @@
:
Rights:
-
- #{rights}# +
#{rights}#
- #{/rights}# -
+ #{/rights}#
:
:
diff --git a/htroot/Status_p.inc b/htroot/Status_p.inc index 6c6275622..715b0815c 100644 --- a/htroot/Status_p.inc +++ b/htroot/Status_p.inc @@ -14,22 +14,17 @@
Processors: #[processors]#
Load: #[load]#
Threads: #[processesCurrentInclDaemon]#/#[processesCurrentOnlyDaemon]#, peak:#[processesPeak]#, total:#[processesTotal]#
- +
Protection
#(protection)# - Password is missing. + Default password is not changed + [Configure] :: password-protected #(/protection)# - - #(unrestrictedLocalAccess)# - :: -
Unrestricted access from localhost. - #(/unrestrictedLocalAccess)# - [Configure]
- +
Address
Host: #[host]#:#[port]# #(extPortFormat)#::| (Binding to interface: #[extPort]#)#(/extPortFormat)# #(sslSupport)#::| SSL: enabled (port #[sslPort]#)#(/sslSupport)#
#(peerAddress)# @@ -38,12 +33,12 @@ Public Address: http://#[address]#
YaCy Address: http://#[peername]#.yacy #(/peerAddress)#
- + #(portForwarding)#::
Port Forwarding Host
#[host]#:#[port]# (#(status)#broken::connected#(/status)#)
#(/portForwarding)# - +
Proxy
Transparent #(info_isTransparentProxy)#on::off#(/info_isTransparentProxy)#   URL #(info_proxyURL)#on::off#(/info_proxyURL)#
@@ -56,7 +51,7 @@ Enabled [Disable] #(/popup)# - +
Tray-Icon
#(tray)# @@ -67,7 +62,7 @@ Experimental #(/tray)#
- +
Memory Usage
@@ -75,13 +70,13 @@
RAM used:#[usedMemory]#
DISK used:(approx.) #[usedDisk]#
DISK free:#[freeDisk]#
- +
Traffic [Reset]
Proxy: #[trafficProxy]#
Crawler: #[trafficCrawler]#
- +
Incoming Connections
Active: #[connectionsActive]# | Max: #[connectionsMax]#
- +
Queues
Loader Queue: @@ -110,7 +105,7 @@
- +
Seed server
#(seedServer)# @@ -124,7 +119,7 @@ Last upload: #[lastUpload]# ago. #(/seedServer)#
- +
\ No newline at end of file diff --git a/source/net/yacy/data/TransactionManager.java b/source/net/yacy/data/TransactionManager.java index 114ca31fc..c0e12fc7d 100644 --- a/source/net/yacy/data/TransactionManager.java +++ b/source/net/yacy/data/TransactionManager.java @@ -63,18 +63,14 @@ public class TransactionManager { */ private static String getUserName(final RequestHeader header) { String userName = header.getRemoteUser(); + if (userName == null) userName = "admin"; // set a default to be able to create a transaction token Switchboard sb = Switchboard.getSwitchboard(); if (sb != null) { final String adminAccountBase64MD5 = sb.getConfig(SwitchboardConstants.ADMIN_ACCOUNT_B64MD5, ""); final String adminAccountUserName = sb.getConfig(SwitchboardConstants.ADMIN_ACCOUNT_USER_NAME, "admin"); - if (adminAccountBase64MD5.equals(sb.emptyPasswordAdminAccount)) { - // admin users with empty passwords do not need to authentify, thus do not have - // this header present. We just consider the name is "admin" - userName = adminAccountUserName; - } - if (userName == null && header.accessFromLocalhost()) { + if (header.accessFromLocalhost()) { if (sb.getConfigBool(SwitchboardConstants.ADMIN_ACCOUNT_FOR_LOCALHOST, false)) { /* Unauthenticated local access as administrator can be enabled */ @@ -134,7 +130,7 @@ public class TransactionManager { /* Check this comes from an authenticated user */ final String userName = getUserName(header); if (userName == null) { - throw new IllegalArgumentException("User is not authenticated"); + throw new IllegalArgumentException("User is not authenticated"); } /* Produce a token by signing a message with the server secret key : diff --git a/source/net/yacy/htroot/ConfigAccounts_p.java b/source/net/yacy/htroot/ConfigAccounts_p.java index 020b1aa47..c2c75b394 100644 --- a/source/net/yacy/htroot/ConfigAccounts_p.java +++ b/source/net/yacy/htroot/ConfigAccounts_p.java @@ -112,9 +112,10 @@ public class ConfigAccounts_p { } } - if (env.getConfig(SwitchboardConstants.ADMIN_ACCOUNT_B64MD5, "").isEmpty() && !env.getConfigBool(SwitchboardConstants.ADMIN_ACCOUNT_FOR_LOCALHOST, false)) { - prop.put("passwordNotSetWarning", 1); - } + // set a warning in case that the default password was not changed + String currpw = sb.getConfig(SwitchboardConstants.ADMIN_ACCOUNT_B64MD5, ""); + String dfltpw = SwitchboardConstants.ADMIN_ACCOUNT_B64MD5_DEFAULT; + prop.put("changedfltpw", currpw.equals(dfltpw) ? "1" : "0"); prop.put(SwitchboardConstants.ADMIN_ACCOUNT_All_PAGES + ".checked", sb.getConfigBool(SwitchboardConstants.ADMIN_ACCOUNT_All_PAGES, false) ? 1 : 0); prop.put("localhost.checked", (localhostAccess) ? 1 : 0); diff --git a/source/net/yacy/htroot/Status.java b/source/net/yacy/htroot/Status.java index ba394466f..459b17af7 100644 --- a/source/net/yacy/htroot/Status.java +++ b/source/net/yacy/htroot/Status.java @@ -131,14 +131,10 @@ public class Status prop.put("privateStatusTable", ""); } - // password protection - if ( (sb.getConfig(SwitchboardConstants.ADMIN_ACCOUNT_B64MD5, "").isEmpty()) - && (!sb.getConfigBool(SwitchboardConstants.ADMIN_ACCOUNT_FOR_LOCALHOST, false)) ) { - prop.put("protection", "0"); // not protected - prop.put("urgentSetPassword", "1"); - } else { - prop.put("protection", "1"); // protected - } + // password protection: set a warning in case that the default password was not changed + String currpw = sb.getConfig(SwitchboardConstants.ADMIN_ACCOUNT_B64MD5, ""); + String dfltpw = SwitchboardConstants.ADMIN_ACCOUNT_B64MD5_DEFAULT; + prop.put("protection", currpw.equals(dfltpw) ? "0" : "1"); if ( sb.getConfigBool(SwitchboardConstants.ADMIN_ACCOUNT_FOR_LOCALHOST, false) ) { prop.put("unrestrictedLocalAccess", 1); diff --git a/source/net/yacy/http/YaCySecurityHandler.java b/source/net/yacy/http/YaCySecurityHandler.java index 1014a1edd..4c1e2e6a5 100644 --- a/source/net/yacy/http/YaCySecurityHandler.java +++ b/source/net/yacy/http/YaCySecurityHandler.java @@ -84,10 +84,6 @@ public class YaCySecurityHandler extends ConstraintSecurityHandler { // Pages suffixed with "_p" are by the way always considered protected protectedPage = protectedPage || (pathInContext.indexOf("_p.") > 0); - // ..except that the password for the admin account is empty - final String adminAccountBase64MD5 = sb.getConfig(SwitchboardConstants.ADMIN_ACCOUNT_B64MD5, ""); - protectedPage = protectedPage && !adminAccountBase64MD5.equals(sb.emptyPasswordAdminAccount); - // check "/gsa" and "/solr" if not publicSearchpage if (!protectedPage && !sb.getConfigBool(SwitchboardConstants.PUBLIC_SEARCHPAGE, true)) { protectedPage = pathInContext.startsWith("/solr/") || pathInContext.startsWith("/gsa/"); @@ -98,6 +94,7 @@ public class YaCySecurityHandler extends ConstraintSecurityHandler { return null; } else if (accessFromLocalhost) { // last chance to authorize using the admin from localhost + final String adminAccountBase64MD5 = sb.getConfig(SwitchboardConstants.ADMIN_ACCOUNT_B64MD5, ""); final String credentials = request.getHeader(RequestHeader.AUTHORIZATION); if (credentials != null && credentials.length() < 120 && credentials.startsWith("Basic ")) { // Basic credentials are short "Basic " + b64(user:pwd) final String foruser = sb.getConfig(SwitchboardConstants.ADMIN_ACCOUNT_USER_NAME, "admin"); diff --git a/source/net/yacy/search/Switchboard.java b/source/net/yacy/search/Switchboard.java index 50902296e..39f856ea3 100644 --- a/source/net/yacy/search/Switchboard.java +++ b/source/net/yacy/search/Switchboard.java @@ -316,7 +316,6 @@ public final class Switchboard extends serverSwitch { private boolean startupAction = true; // this is set to false after the first event private static Switchboard sb; public HashMap crawlJobsStatus = new HashMap<>(); - public String emptyPasswordAdminAccount; public Switchboard(final File dataPath, final File appPath, final String initPath, final String configPath) { super(dataPath, appPath, initPath, configPath); @@ -449,9 +448,6 @@ public final class Switchboard extends serverSwitch { } }.start(); - // define the "non-password password" - this.emptyPasswordAdminAccount = this.encodeDigestAuth(this.getConfig(SwitchboardConstants.ADMIN_ACCOUNT_USER_NAME,"admin"), ""); - // init the language detector this.log.config("Loading language profiles"); try { @@ -3907,13 +3903,10 @@ public final class Switchboard extends serverSwitch { /** * check authentication status for request access shall be granted if return value >= 2; these are the * cases where an access is granted to protected pages: - * - a password is not configured: auth-level 2 * - access from localhost is granted and access comes from localhost: auth-level 3 - * - a password is configured and access comes from localhost and the realm-value + * - access comes from localhost and the realm-value * of a http-authentify String is equal to the stored base64MD5: auth-level 3 - * - an empty password is configured an access comes from anywhere: auth-level 3 - * This may be used in cluster installations where the cluster has an outside protection but inside is none needed. - * - a password is configured and access comes with matching http-authentify: auth-level 4 + * - access comes with matching http-authentify: auth-level 4 * * @param requestHeader * - requestHeader.AUTHORIZATION = B64encode("adminname:password") or = B64encode("adminname:valueOf_Base64MD5cft") @@ -3931,19 +3924,6 @@ public final class Switchboard extends serverSwitch { return 4; // hard-authenticated, quick return } - // authorization in case that there is no account stored - final String adminAccountUserName = this.getConfig(SwitchboardConstants.ADMIN_ACCOUNT_USER_NAME, "admin"); - final String adminAccountBase64MD5 = this.getConfig(SwitchboardConstants.ADMIN_ACCOUNT_B64MD5, ""); - if ( adminAccountBase64MD5.isEmpty() ) { - this.adminAuthenticationLastAccess = System.currentTimeMillis(); - return 2; // no password stored; this should not happen for older peers - } - - // authorization in case that administrators have stored an empty password; this authorizes all users as admin regardless of the give auth - if (adminAccountBase64MD5.equals(this.emptyPasswordAdminAccount)) { - return 3; // everyone is admin from everywhere - } - // authorization for localhost, only if flag is set to grant localhost access as admin final boolean accessFromLocalhost = requestHeader.accessFromLocalhost(); if (accessFromLocalhost && this.getConfigBool(SwitchboardConstants.ADMIN_ACCOUNT_FOR_LOCALHOST, false)) { @@ -3980,6 +3960,8 @@ public final class Switchboard extends serverSwitch { } // authorization by encoded password, only for localhost access + final String adminAccountUserName = this.getConfig(SwitchboardConstants.ADMIN_ACCOUNT_USER_NAME, "admin"); + final String adminAccountBase64MD5 = this.getConfig(SwitchboardConstants.ADMIN_ACCOUNT_B64MD5, ""); final String pass = Base64Order.standardCoder.encodeString(adminAccountUserName + ":" + adminAccountBase64MD5); if ( accessFromLocalhost && (pass.equals(realmValue)) ) { // assume realmValue as is in cfg this.adminAuthenticationLastAccess = System.currentTimeMillis();