Unsafe first setup of administrator credentials on fully exposed website

[ackalker]

The current installation process requires setting up administrator credentials via a web browser, leaving the Pangolin server unsecured and fully exposed to the internet during this period. This creates a critical security window where an attacker could claim the administrator account and gain access to all proxied resources.

Previously, administrator setup was handled securely via the terminal (see commit d03f452). I strongly recommend restoring this option or, at minimum, providing a way to restrict or protect the initial web-based setup (e.g., setup tokens, IP whitelisting, or time-limited URLs).

Potential Impact:

• Unauthorized control of Pangolin instance
• Exposure of all connected services
• Possible lateral movement within private networks

Recommendations:

• Restore terminal-based admin setup
• Make web-based setup optional or protected
• Consider additional mitigations to limit attack surface during setup

[miloschwartz]

Hi, thanks. We introduced the terminal based CLI tool and the initial GUI setup simultaneously because the previous versions required the password be set in a file which wasn't ideal for many.

If someone beat you to the setup page to create the credentials they would control that account, but since the instance is empty at this point in time, you could also clear the DB or reset the password with the CLI since you control the server. Once the admin account is created, it cannot be changed or manipulated via the GUI, you have to use the CLI.

We can work on making this opt out via a question in the installer for those who would prefer to signup the first user via the CLI only.

[inspectorgadjet7]

Alternatively, don't open your 80 and 443 ports to everyone when you first install. Only open the ports for your IP address until you've configured everything the way you want it.

[miloschwartz]

@inspectorgadjet7 Good idea!

[TheBigBear]

This is unsafe as the ticket says.
Two suggestions, maybe the installer should prompt for an initial IP to be allowed for initial administrator credentials changes or setup, or it should generate some random long string it displays during setup that the owner has to use to connect.

[Error-Gap]

Alternatively, don't open your 80 and 443 ports to everyone when you first install. Only open the ports for your IP address until you've configured everything the way you want it.

The docker container pretty much automatically creates the rules that open ports though, and not everyone is running a configurable firewall in front of their instance (especially if they're hosted).

An easy way to safeguard this would be:
Require an secret in the config file in order to create the admin account
i.e.

server:
        admin_token: "password123"

Then prompt for it at the initial account creation page. That way the only person who should have access to the secret is going to be somebody with admin access to the server it's hosted on.

[github-actions]

This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.

[oschwartz10612]

Resolved by #1208