Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Problem: Add dialog to prompt user to change the default IceCast password upon install #86

Open
Robbt opened this issue Mar 15, 2017 · 12 comments

Comments

@Robbt
Copy link
Member

commented Mar 15, 2017

Since many users will be just rolling this out without much expertise, we should at least try to encourage secure installations.

Taking a queue from the how the setup dialog prompts the user to change their rabbitmq password, we should also include something that asks them to change their icecast password or perhaps handle this via the web interface and then saves it automatically.
Or perhaps it can autogenerate a secure password and seed it into the web interface/icecast config.

Ideally the rabbitmq password prompt would be handled better in the same way as well since most people will likely ignore the prompt and just use the default password thus creating a potential vulnerability.

@squiggleuk

This comment has been minimized.

Copy link

commented Mar 15, 2017

When going through the setup, I always presume that changing the rabbitmq password would break everything on the following pages... Autogenerating a secure password feels like the best way. Maybe have somewhere in admin/settings that displays it and allows it to be changed? (So Libretime and IceCast password remain in sync)

@hairmare

This comment has been minimized.

Copy link
Member

commented Mar 15, 2017

My understanding is to use the advanced rabbitmq setup with a different password if you prepared your server manually with a proper password. This google search shows me that the manual needs some info on manually setting up a secure rabbitmq.

The manual is also missing a walkthrough of the initial setup with more explanations, in fact I see no mention of the whole setup routine in the docs. We might opt to add links to this in the setup dialogs and also maybe reword the dialog.

@hairmare hairmare added the security label Mar 15, 2017

@hairmare hairmare modified the milestone: 3.0.0-alpha.1 Mar 18, 2017

@squiggleuk

This comment has been minimized.

Copy link

commented Mar 20, 2017

Could we do something like this in the install script?

icecastPass=$(date | md5sum | cut -c1-9)
icecastConfig="/etc/icecast2/icecast.xml"

sed -E -i "s/()(.)(</source-password>)/\1$icecastPass\3/" $icecastConfig
sed -E -i "s/()(.
)(</relay-password>)/\1$icecastPass\3/" $icecastConfig
sed -E -i "s/()(.)(</admin-password>)/\1$icecastPass\3/" $icecastConfig
sed -E -i "s/()(.
)(</master-password>)/\1$icecastPass\3/" $icecastConfig

#update database with $icecastPass

@frecuencialibre

This comment has been minimized.

Copy link
Contributor

commented Dec 10, 2018

continuing here the conversation started over in a docker repo ned-kelly/docker-multicontainer-libretime#20 (comment)

@Robbt in response to your comment re: security, any reason why editing icecast.xml would be more of a concern than the editing of other files, such as airtime.conf, that the installer is already doing?

@Robbt

This comment has been minimized.

Copy link
Member Author

commented Dec 10, 2018

I suppose it isn't a bigger security concern but it would involve altering the permissions for the icecast file so that www-data could right it or perhaps adding www-data to the icecast group. Whereas airtime.conf has only ever been owned by www-data. The path forward on multiple distributions is less obvious but could be figured out.

@Robbt

This comment has been minimized.

Copy link
Member Author

commented Dec 10, 2018

Then in addition we would need to load and parse the XML file and write the appropriate passwords etc back and then have the user reboot icecast2 at the end. I think the XML stuff can be done with Simple XML or DOMDocument. This should be doable but it'll take a little bit of work in a few different places and the appropriate troubleshooting.

@Robbt

This comment has been minimized.

Copy link
Member Author

commented Dec 18, 2018

So my preference for this would be for the install script that runs as root to choose random values and then insert these into the icecast XML file and seed the database. Then we can make this secure by default without requiring action by the user and they can modify it if they want. We will probably need to make the default streaming settings user configurable.

@JohnnyC1951

This comment was marked as off-topic.

Copy link

commented Dec 18, 2018

Just a note: I have noticed that just restarting Icecast does not seem to reload icecast.xml
So I stop and then start it and it does.

@frecuencialibre

This comment has been minimized.

Copy link
Contributor

commented Dec 19, 2018

@ned-kelly do you have any opinion on the approach @Robbt describes in his comment above?

@paddatrapper

This comment has been minimized.

Copy link
Contributor

commented Dec 20, 2018

Debian and Ubuntu already prompt to change the Icecast password when installing the icecast2 package.

I would also suggest that it be behind a prompt in the installer to account for people installing Icecast on a different server/already set the password/etc

@Robbt

This comment has been minimized.

Copy link
Member Author

commented Dec 21, 2018

@paddatrapper so maybe the way we are installing the deb packages is circumventing this prompt and we could re-enable it or somehow hook into it ? I don't want to reinvent the wheel here but I also don't want people to have hackme as their icecast password when they install it and don't know any better.

@paddatrapper

This comment has been minimized.

Copy link
Contributor

commented Dec 21, 2018

It is probably how we are installing it, using --quiet, which I think we do when installing using the script, will suppress these prompts.

My suggestion would be to not use that flag during install or promote the use of the LT deb once I get airtime-celery systemd unit running properly, because that will install using the prompt by default

@Robbt Robbt added this to the 3.0.0 milestone Jan 18, 2019

@Robbt Robbt moved this from To do to Documentation Todo in Beta Release Blocker Tracking Board Apr 23, 2019

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.