We use a predefined admin user in our web application.
The configured password is very long and different for each installation and we have implemented brute force mitigations.
What are the security concerns of having a predefined user?
-
Is the password the same across all instances of the app? Then length is irrelevant, and the password should be considered compromised (because a user is only relevant if it can be logged into, which requires disclosing the password). Otherwise we need more details. Just from an "it exists" standpoint it's not terrible, since almost every application is going to end up with an "admin" account, or have other easily guessable/discoverable login ids. – Clockwork-Muse Dec 28 '18 at 8:12
-
1The question does not provide enough details to answer the problem. It is not clear what the abilities of this users are and how hard it is in reality to determine the users password (maybe because the same product with the same password is installed on multiple sites, where local admins thus might be able to extract the password). Also, why do you need such predefined user in the first place - such fixed (and hidden) accounts are often considered a backdoor. – Steffen Ullrich Dec 28 '18 at 8:20
-
I have updated the question – Michael Dec 28 '18 at 8:26
-
1@Michael: Given your description so far the only difference compared to accounts which are not pre-defined should be that a) the user name is known and b) the user might have a stronger password and c) maybe some hard-coded permissions which are unavailable for other accounts. b) should not be a problem. If a) or c) are a problem depends on the details of your specific application - which are unknown. – Steffen Ullrich Dec 28 '18 at 8:46
-
How is the unique password generated? – David Kamer Dec 28 '18 at 21:16
You should insert this user into your database uniquely for each installation instead of hard coding the account or at least give the ability to disable the account as well as reset the accounts password. You cannot begin to predict how this backdoor admin account you are creating could be abused in the future. Maybe your company's sensitive files are breached including all your installation passwords and now you need to quickly disable the account. Maybe an attacker uncovers a vulnerability in your hardcoded admin account logic and suddenly you have no way to remove it. It's better to give yourself options in the case of a breach like a) ability to Delete account b) ability to disable account c) ability to rename account d) ability to reset password
