Disable anonymous admin from foreman-rake

Support
1

For troubleshooting I used the foreman-rake console with "User.current =
User.anonymous_admin".

This enables me to do several things to our foreman environment without
authenticating. How can I disable this for security purposes?

The anonymous admin is not the same user as the foreman admin it seems:

irb(main):002:0* User.current = User.anonymous_admin
=> #<User id: 1, login: "foreman_admin", firstname: "Anonymous",
lastname: "Admin", mail: nil, admin: true, last_login_on: nil,
auth_source_id: 2, created_at: "2016-09-28 08:09:17", updated_at:
"2016-09-28 08:09:17", password_hash: nil, password_salt: nil,
locale: nil, avatar_hash: nil, default_organization_id: nil,
default_location_id: nil, lower_login: "foreman_admin",
mail_enabled: true, timezone: nil>

Met vriendelijke groet, With kind regards,

Jorick Astrego

Netbulae Virtualization Experts

··· ---------------- 
Tel: 053 20 30 270 	info@netbulae.eu 	Staalsteden 4-3A 	KvK 08198180
Fax: 053 20 30 271 	www.netbulae.eu 	7547 TA Enschede 	BTW NL821234584B01
2

You can't, and it'd be rather pointless as it's trivial to work around.
The console is a fully interactive Ruby script that you're executing, so
any in-process security measure can be bypassed easily.

Executing any foreman-rake command successfully indicates you already
have direct access to the database because the console process itself
connects to the DB. Probably via a Unix domain socket and optionally
with username/password stored in /etc/foreman/database.yml.

You should restrict access to the database and credentials to tighten
security, not try to restrict behaviour of this one script that accesses it.

··· On 06/10/16 11:33, Jorick Astrego wrote: > For troubleshooting I used the foreman-rake console with "User.current = > User.anonymous_admin". > > This enables me to do several things to our foreman environment without > authenticating. How can I disable this for security purposes?

–
Dominic Cleal
dominic@cleal.org

3

Thanks for the info!

My knowledge of ruby is not so great, so I hadn't realized it was
talking to the db.

I'll have to dive more into it :wink:

Met vriendelijke groet, With kind regards,

Jorick Astrego

Netbulae Virtualization Experts

··· On 10/06/2016 12:43 PM, Dominic Cleal wrote: > On 06/10/16 11:33, Jorick Astrego wrote: >> For troubleshooting I used the foreman-rake console with "User.current = >> User.anonymous_admin". >> >> This enables me to do several things to our foreman environment without >> authenticating. How can I disable this for security purposes? > You can't, and it'd be rather pointless as it's trivial to work around. > The console is a fully interactive Ruby script that you're executing, so > any in-process security measure can be bypassed easily. > > Executing any foreman-rake command successfully indicates you already > have direct access to the database because the console process itself > connects to the DB. Probably via a Unix domain socket and optionally > with username/password stored in /etc/foreman/database.yml. > > You should restrict access to the database and credentials to tighten > security, not try to restrict behaviour of this one script that accesses it. > ---------------- 
Tel: 053 20 30 270 	info@netbulae.eu 	Staalsteden 4-3A 	KvK 08198180
Fax: 053 20 30 271 	www.netbulae.eu 	7547 TA Enschede 	BTW NL821234584B01