Security problem?

[ScaredyCat]

Hi,

I have a guest account setup in cacti, but the user has to log in with a password. The problem is if I put:

Code: Select all

http://<ip-address-of-cacti-box>/cacti/graph_view.php?action=preview&host_id=1&filter=

in my browser (even after clearing cache, closing browser etc) I can still see anything I want (in the graphs section).

Shouldn't this force a login?

SC

[rony]

Nope, it shouldn't..... Guest access does not validate the password. It just uses the permissions of the guest, if enabled, to allow anonymous viewing of graphs. So you should make sure that the guest account has minimal rights.

[ScaredyCat]

Nope, it shouldn't..... Guest access does not validate the password. It just uses the permissions of the guest, if enabled, to allow anonymous viewing of graphs. So you should make sure that the guest account has minimal rights.

Guest access from the login page validates the password, why would it not be forced to log in - ie you can bypass it. Seems a bit odd that's all..

SC

[rony]

When you goto graph_view.php and are not already logged in, cacti will attempt to use the defined "Guest User" to grant access, without a password, allowing anonymous access. This behavor is complete intential.

If you would like to disable this, and require guest to use a password to view graphs, then you need to remove the "Guest User" from the Settings->Authenication.

[ScaredyCat]

When you goto graph_view.php and are not already logged in, cacti will attempt to use the defined "Guest User" to grant access, without a password, allowing anonymous access. This behavor is complete intential.

If you would like to disable this, and require guest to use a password to view graphs, then you need to remove the "Guest User" from the Settings->Authenication.

Perfect - removed the guest access and it forced the login page so the guest account could log in - thanks...

I was just a little concerned I didn't see any reference to this in the docs. Perhaps it's worth highlighting - then again I may just be paranoid...

SC

[rony]

Next major version of cacti will have the guest user access disabled by default and it will be fully documented.