Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Option to disable customer login #1219

Closed
realrellek opened this issue Jan 2, 2024 · 0 comments
Closed

Option to disable customer login #1219

realrellek opened this issue Jan 2, 2024 · 0 comments
Assignees
Milestone

Comments

@realrellek
Copy link

Is your feature request related to a problem? Please describe.
Picture this. You have a server and want to manage your own websites only. That would mean you don't really need a customer per se. But you need one because that is how everything is organised. However, it is mostly you and you alone. And if you need to, say add a database, you would log in as your Admin user, go to Customers, and click the name.
This however does not stop the customer from having login credentials (which is fine because that password is also the default password for the FTP).
However, that adds something for an attacker to find out the password.

Yes, you can add 2FA for that user but that'd be yet another entry in your password manager you will never use in this scenario.

Describe the solution you'd like
I would like an option for a customer to not be able to log in into Froxlor. It still exists and is not suspended and everything works as expected and as it is now but Froxlor would just deny a login attempt as if the credentials were wrong.

I think this would be fairly easy to implement. I am not sure how the login system works exactly, but I would believe at some point Froxlor checks the database if the user exists, gets all the data, compares the password and creates a session or throws an error. If the checkbox was checked, it would just pretend the password was wrong.

Describe alternatives you've considered
Doing it as is right now and adding a pointless entry into the password manager, and because of the paranoia, also activate 2FA. But if you're alone on the server, you will never use it, so not only does it sleep in your password manager, it also is another set of possibly dangerous login credentials an attacker could bruteforce, or exploit a security vulnerability or whatever. You never know (not saying it is a problem or anything, just hypothetically)

Additional context
(This page intentionally left blank.)

@d00p d00p added this to the 2.2.x milestone Jan 2, 2024
@d00p d00p self-assigned this Jan 2, 2024
@d00p d00p closed this as completed in 284def5 Jan 7, 2024
z-e-r-0-t pushed a commit to z-e-r-0-t/Froxlor that referenced this issue Jan 18, 2024
…o the webui; fixes froxlor#1219

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: Done
Development

No branches or pull requests

2 participants