We use a predefined admin
user in our web application.
The configured password is very long and different for each installation and we have implemented brute force mitigations.
What are the security concerns of having a predefined user?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this communityWe use a predefined admin
user in our web application.
The configured password is very long and different for each installation and we have implemented brute force mitigations.
What are the security concerns of having a predefined user?
You should insert this user into your database uniquely for each installation, instead of hard-coding the account, or at least give the ability to disable the account as well as reset the account's password.
You cannot predict how this backdoor admin account you are creating could be abused in the future. Maybe your company's sensitive files are breached including all your installation passwords and now you need to quickly disable the account. Maybe an attacker uncovers a vulnerability in your hard-coded admin account logic and suddenly you have no way to remove it.
It's better to give yourself options in the case of a breach like: