MichaelN0815
commented
1 year ago Abschaffung von Password-less Account - würde ich unterstützen. Die Komplexität oder gar zwangsweise Erneuerung des PWD würde ich nicht einführen. Das ist nur eine Scheinsicherheit. Als allererstes würde ich vor allem den AutoLogin abschaffen und beim nächsten FW-Update auch abschalten, falls es aktiv ist. Denn für diesen Angriffsvektor benötigt man aktuell NULL Hacking-Skills, da die WebUI einfach offen darliegt. Ach so: HTTPS nützt da auch nichts.
Und was ggf. Helfen könnte - ähnlich wie bei der Fritz! Box - Jeder Login oder mindestens jeder Zugriff auf die User-Konfiguration löst eine Meldung per Mail aus. Haken ist natürlich: es müsste eine Mail-Adresse und ein Mail-Server konfiguriert sein. Also bei 99% der User wird dann nichts passieren.
Sineos
dirkbe
jens-maus
jp112sdl
Silverstar
Describe the solution you'd like
Because of certain common security concerns in the CCU/OCCU ecosystem and especially due to the point that users still unfortunately tend to make a CCU available via plain router port forwarding from the internet a CCU is commonly prone to public hacking attempts (see https://homematic-forum.de/forum/viewtopic.php?f=26&t=77643&p=753591#p753517, etc.)
It is therefore desirable to think about introducing certain changes for a general security hardening so that public hacking attempts or attack vectors are significantly reduced or even completely eliminated. Therefore, a list should be maintained with changes in the CCU/OCCU/RaspberryMatic ecosystem which could be performed with the potential of hardening the general security of the WebUI or other internal APIs of the CCU/OCCU ecosystem:
[ ] Remove possibility to setup password-less WebUI access Idea: Remove possibility to setup WebUI being accessible without any password, thus even guest accounts should require a password. In addition a warning should be added when setting up non-admin accounts in the WebUI with the clear warning that this feature does not prevent a guest or normal user account from performing admin operations due to certain internal WebUI security flaws. Thus, the possibility to differentiate between guest, normal and admin user is just meant to provide a possibility to present different WebUI views but does not protect e.g. that a guest account won't be able to perform admin operations, e.g. on the available APIs.
[ ] Introduce password complexity checks Idea: When changing a password its complexity should be checked and too easy passwords should be rejected by password change algorithm. Potentially, this password complexity check should be performed upon login as well and a user forced to change password if not complex enough
[ ] Force HTTPS being used Idea: static port 80 -> 443 redirection and no possibility to disable https/443 being used. Requires changes to initial setup routine to notify users that with own SSL certificates browsers will warn about potentially invalid certificates which need to be accepted. After accepting this warning permanent http->https redirection should be setup.
[ ] Additional firewall rules to allow port 80/443 (or generally all ports) only from local subnets: Idea: Allow access only from subnets available from the CCU itself (e.g. 192.168.x.x) and allow to configure additional subnets in the WebUI. This should prevent port forwarding being used or being limited to specific IPs/IP-ranges only.
[ ] Remove user name buttons at login screen Idea: User name buttons unnecessarily disclose existing user accounts. Although this can be configured in the user section many installations likely show user names on the home page. Unused or forgotten accounts may also have weak passwords and represent entry points.
[ ] Security assistant: Report Idea: Add a report or security guide under control panel/security assistant to scan for recommended settings, e.g. user names with simple passwords, users with admin rights, weak security settings, e.g. http, open API ports, firewall settings, last backup, old (vulnerable) firmware/additional software, ... Please note that this list should serve as loose list of ideas with suggested solutions to improve the security of the WebUI or other underlying APIs that are being commonly used for public hacking attempts.
[ ] Improve CCU-Addon Security: Some addons (XML-API, CCU-Jack, etc.) provide functionality to provide APIs (even on port 80/443) without forcing authentification and also partly with reelaxed CORS protection (Origin "*" Header). If a user is then using simple port forwarding from outside the CCU context this represents a servere attack window, especially if these addons provide functionality to execute arbitrary script code. Thus, all addons should be changed to require proper session authentication and do not come with relaxed CORS headers.
Describe alternatives you've considered
n/a
Is your feature request related to a problem?
Due to internal feature constraints security of the whole CCU/OCCU including its WebUI is an general concern.
Additional information
https://homematic-forum.de/forum/viewtopic.php?f=26&t=77643&p=753591#p753517