- Status Unconfirmed
- Percent Complete
- Task Type Bug Report
- Category Base system
- Assigned To No-one
- Operating System All
- Severity Critical
- Priority Very Low
- Reported Version All
- Due in Version Undecided
-
Due Date
Undecided
- Private
FS#2634 - Luci allows access if root password is cleared and locked
Luci doesn’t correctly handle a disabled, empty password for root.
Deleting and disabling the root password makes the luci interface accessible without a password.
Steps to reproduce:
- Delete root password (passwd -d root)
- Lock root password (passwd -l root)
- Try to access Luci
luci → rpcd