mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2025-12-10 01:10:09 +03:00
Question: why is ADMIN_TOKEN not mandatory #240
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @jflecool2 on GitHub.
Hello!
First, thanks for creating vaultwarden!!
I have a question,
Considering vaultwarden store passwords, (safety is primordial)
Considering a argon 'ADMIN_TOKEN' is necessary to be safe (according to https://github.com/dani-garcia/vaultwarden/releases/tag/1.33.0)
Why is ADMIN_TOKEN not forced?
If I wouldnt have checked the new release, I would have never known. Its maybe in the log (?), but I dont think every one looks at the logs. I know I dont.
Thanks
@stefan0xC commented on GitHub:
I'd recommend never setting
DISABLE_ADMIN_TOKEN=true. If you need the/adminpanel, I'd probably recommend setting up an additional form of access control (i.e. restricting it to a specific IP address / VPN) instead. I mean, disabling it and only enabling it when needed, should be fine too but personally I think that would be a bit of a hassle.@stefan0xC commented on GitHub:
If you have no
ADMIN_TOKEN(norDISABLE_ADMIN_TOKEN=true) set, the/adminpanel is not active and there would have been no security flaw to be exploited. Or to quote the linked advisory@BlackDex commented on GitHub:
And this, as @stefan0xC says, you need to disable it specificaly and the token is mandatory
@BlackDex commented on GitHub:
If you just set a token, and maybe as extra add basic auth or authelia or something via your reverse proxy, that should be more then enough.
@7heMech commented on GitHub:
Hey, sorry to chip in, would you guys recommend keeping admin disabled until changes need to be made?
@BlackDex commented on GitHub:
Yes / No. The security issue is already fixed, with or without admin token. But it's not adviced.
No since
DISABLE_ADMIN_TOKENas the option says disables the token, and thus rendersADMIN_TOKENnot used.@stefan0xC commented on GitHub:
No.
DISABLE_ADMIN_TOKENis inherently unsafe as it straight up enables the/adminpanel to be used without a password. The idea would be that you are responsible for setting up a separate auth layer as described by the comment.3c29f82974/.env.template (L395-L397)So personally I think that option in itself is a security flaw, which is why I'd never recommend enabling it.
@BlackDex commented on GitHub:
Also, i would not change settings via the admin interface though. Only checking users and orgs, and diagnostics.
@jflecool2 commented on GitHub:
Ok I think I get it:
correct ?
@7heMech commented on GitHub:
Oh, well, I setup everything from there already 😓
My instance is proxied behind cloudflare, I could setup some rules over there for /admin yeah, thanks so much for the advice!
@jflecool2 commented on GitHub:
Ok I understand!
From where I stand, default is safe, ADMIN_TOKEN is safe, and DISABLE_ADMIN_TOKEN is somewhat inherently unsafe but the name already implies that its unsafe in my opinion, so its fine. thanks guys! Vaultwarden rocks!