Welcome Guest Search | Active Topics | Log In | Register

ACL for eJadSPM , It's a big Joke , The automatic installer compromise the server security Options · View
onemancrew
#1 Posted : Monday, February 18, 2008 8:00:16 AM

Rank: eJadSPM Learner

Groups: Member

Joined: 2/18/2008
Posts: 5
Points: 15
Today I have installed eJadSPM.
I see that the installer has created a new user: "eJadSPM_Web"
I also see that this user is member of group called "Administrators"

Developers , are you insane ?
Which programmer configuring such ACL ? we are talking about web application which has access from ANY !!!

Now let's move to the User of the Application Pool which eJadSPM is running under it.
The automatic installer has configured it to run as "local system".
Again , security compromised !!!
why not to use the same user "eJadSPM_Web" ?

The developers need to take the web application back to the sketch desk.
aziz
#2 Posted : Monday, February 18, 2008 11:36:52 PM

Rank: Management

Groups: Administration , Member

Joined: 11/11/2007
Posts: 81
Points: 324
Location: Dubai
"eJadSPM_Web" user MUST be a Administrators group member because eJadSPM is not just an ordinary web application. It is the control system to manage and run all aspects of your business and for that it requires administrative access to your network and servers. For example, when you configure Network Monitoring the application control panel should be running under Administrative right otherwise it cannot monitor remote servers and ports. Another example is Servers Management, the application cannot show you disk usage graphs, running processes, event logs, etc unless proper permissions are set.

eJadSPM's security model is well thought and well designed. The way installer configures application is intentional and a REQUIREMENT for its operations.

I hope this help you understand Think
--
Aziz Paracha
Vice President/CTO
MachPanel (formerly eJadSPM System) -- SaaS Enabled Hosted Service Delivery Platform
www.machsol.com
We offer world's only affordable consolidated platform for SaaS providers. Is there a company that beats our pricing? let me know!
BogdanF
#3 Posted : Wednesday, October 22, 2008 8:42:07 AM

Rank: eJadSPM Learner

Groups: Member

Joined: 10/19/2008
Posts: 11
Points: 33
Location: NA
Quote:
eJadSPM's security model is well thought and well designed. The way installer configures application is intentional and a REQUIREMENT for its operations.


Although I understand that the web application is required to perform some tasks with administrative privileges, I do agree with the OP that under no circumstances should you run a web application that is exposed to the Internet with those credentials. I believe that you guys tried to keep things as simple as possible and might have took the easy was in terms of designing the security of your application, but I'm pretty sure that this will come back some day to haunt you and when it does... well... it's not going to be pretty.

Redesigning the security model now, while your application is still "young", may prove to be a lot easier to do that in about 6 months from now.
aziz
#4 Posted : Friday, October 24, 2008 3:25:31 AM

Rank: Management

Groups: Administration , Member

Joined: 11/11/2007
Posts: 81
Points: 324
Location: Dubai
Thanks for your comments.

One of the major function of eJadSPM is service provisioning which means interaction with many 3rd-party products and performing certain system level operation. These operations cannot be performed without elevated privileges. Since at the moment many calls go directly from the scope of control panel website therefore we must have to set administrative rights. It is however worth mentioning here that we are gradually moving all operations to remoting services and once that is complete we will demote the anonymous user to normal user rights.
--
Aziz Paracha
Vice President/CTO
MachPanel (formerly eJadSPM System) -- SaaS Enabled Hosted Service Delivery Platform
www.machsol.com
We offer world's only affordable consolidated platform for SaaS providers. Is there a company that beats our pricing? let me know!
Users browsing this topic
Guest
Forum Jump  
You cannot post new topics in this forum.
You cannot reply to topics in this forum.
You cannot delete your posts in this forum.
You cannot edit your posts in this forum.
You cannot create polls in this forum.
You cannot vote in polls in this forum.

YAFPro Theme Created by Jaben Cargman (Tiny Gecko)
Powered by YAF 1.9.3 beta | YAF © 2003-2008, Yet Another Forum.NET
This page was generated in 0.159 seconds.