Demo
Demo

Knowledge base

www-auth verifiedcriticalWritten by the Hub

Console credentials

in the configuration this is a linewww-auth: hardcoded://mailerq:mailerq

Where console logins are checked; like the SMTP side, it accepts seven schemes, and like it, the shipped value is a password everyone knows.

Values

Values
hardcoded:// · ldap:// · radius:// · users:// · http:// · file:// · exec://
Default
hardcoded://mailerq:mailerq · taken from the build
applying
restart required
where it can be set
in the config file · with a startup flag · as an environment variable

In detail

The package ships hardcoded://mailerq:mailerq. A node installed from the vendor's package and exposed on port 80 — both defaults — is therefore open to anyone who has read the documentation. Hub replaces it at installation with a generated password, which is the right behaviour and worth keeping in mind when a customer installs MailerQ themselves. The scheme list matches smtp-auth: hard-coded pairs, LDAP, RADIUS, system users, an HTTP endpoint, a file of hashed passwords, or an external program. Several hard-coded pairs may be given at once, separated by commas — and that is where the leak below hurts most. 🔴 The console prints this value verbatim on its own «Config file» screen. Database and broker passwords are masked there; this one is not. Whoever is logged in can read the password they logged in with, and every other account's password too. Verified on the stand.

What happens if you get it wrong

Left at the shipped value.The console is open to anyone who knows the vendor's default — which is published in the documentation.taken from the build · inference
The same password is reused elsewhere.Anyone with console access reads it in clear text on the Config file screen and now has it for the other system too.verified by experiment · inference