Bug 51239 - Portal server runs as root
Portal server runs as root
Status: NEW
Product: UCS
Classification: Unclassified
Component: Portal
UCS 4.4
Other Linux
: P5 normal (vote)
: ---
Assigned To: UMC maintainers
UMC maintainers
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2020-05-07 08:43 CEST by Philipp Hahn
Modified: 2020-05-07 08:54 CEST (History)
1 user (show)

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score: 0.0 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:N)


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Philipp Hahn univentionstaff 2020-05-07 08:43:20 CEST
Running network facing services needlessly as user "root" is a CWE-272 violation of the "Principle of least privilege".

# ps u $(pgrep -f /usr/bin/univention-portal-server)
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root      1905  0.0  1.5 611784 15804 ?        Ss   Mai04   0:02 /usr/bin/python2.7 /usr/bin/univention-portal-server

Nevertheless the service should not run as user "root" but use a dedicated local user account.