mirror of
https://github.com/community-scripts/ProxmoxVE.git
synced 2026-11-09 23:12:53 +01:00
fix(filebrowser): generate the admin password instead of a public one
The addon, filebrowser-quantum and the FileBrowser option of homeassistant and podman-homeassistant created admin with the password community-scripts.org, on a service that runs as root over the whole filesystem. A new install now gets a random password in ~/filebrowser.creds or ~/filebrowser-quantum.creds, and an update replaces the public password on existing installs. Quantum only keeps adminPassword in its config until the admin exists, since it resets the password on every start. The Home Assistant options run the addon instead of their own copy pinned to FileBrowser 2.23.0, the service no longer forces the listen address back to 0.0.0.0, and the no-authentication prompt says what it exposes.
This commit is contained in:
MickLesk
+1
-26
@@ -70,32 +70,7 @@ function update_script() {
|
||||
exit
|
||||
fi
|
||||
if [ "$UPD" == "4" ]; then
|
||||
msg_info "Installing FileBrowser"
|
||||
RELEASE=$(curl -fsSL https://api.github.com/repos/filebrowser/filebrowser/releases/latest | grep -o '"tag_name": ".*"' | sed 's/"//g' | sed 's/tag_name: //g')
|
||||
$STD curl -fsSL https://github.com/filebrowser/filebrowser/releases/download/v2.23.0/linux-$(arch_resolve)-filebrowser.tar.gz | tar -xzv -C /usr/local/bin
|
||||
$STD filebrowser config init -a '0.0.0.0'
|
||||
$STD filebrowser config set -a '0.0.0.0'
|
||||
$STD filebrowser users add admin community-scripts.org --perm.admin
|
||||
msg_ok "Installed FileBrowser"
|
||||
|
||||
msg_info "Creating Service"
|
||||
service_path="/etc/systemd/system/filebrowser.service"
|
||||
echo "[Unit]
|
||||
Description=Filebrowser
|
||||
After=network-online.target
|
||||
[Service]
|
||||
User=root
|
||||
WorkingDirectory=/root/
|
||||
ExecStart=/usr/local/bin/filebrowser -r /
|
||||
[Install]
|
||||
WantedBy=default.target" >$service_path
|
||||
|
||||
$STD systemctl enable --now filebrowser
|
||||
msg_ok "Created Service"
|
||||
|
||||
msg_ok "Completed successfully!\n"
|
||||
echo -e "FileBrowser should be reachable by going to the following URL.
|
||||
${BL}http://$LOCAL_IP:8080${CL} admin|community-scripts.org\n"
|
||||
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/filebrowser.sh)"
|
||||
exit
|
||||
fi
|
||||
}
|
||||
|
||||
@@ -66,33 +66,7 @@ function update_script() {
|
||||
exit
|
||||
fi
|
||||
if [ "$UPD" == "3" ]; then
|
||||
msg_info "Installing FileBrowser"
|
||||
$STD curl -fsSL https://raw.githubusercontent.com/filebrowser/get/master/get.sh | bash
|
||||
$STD filebrowser config init -a '0.0.0.0'
|
||||
$STD filebrowser config set -a '0.0.0.0'
|
||||
$STD filebrowser users add admin community-scripts.org --perm.admin
|
||||
msg_ok "Installed FileBrowser"
|
||||
|
||||
msg_info "Creating Service"
|
||||
cat <<EOF >/etc/systemd/system/filebrowser.service
|
||||
[Unit]
|
||||
Description=Filebrowser
|
||||
After=network-online.target
|
||||
|
||||
[Service]
|
||||
User=root
|
||||
WorkingDirectory=/root/
|
||||
ExecStart=/usr/local/bin/filebrowser -r /
|
||||
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
EOF
|
||||
systemctl enable -q --now filebrowser
|
||||
msg_ok "Created Service"
|
||||
|
||||
msg_ok "Completed successfully!\n"
|
||||
echo -e "FileBrowser should be reachable by going to the following URL.
|
||||
${BL}http://$LOCAL_IP:8080${CL} admin|community-scripts.org\n"
|
||||
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/filebrowser.sh)"
|
||||
exit
|
||||
fi
|
||||
if [ "$UPD" == "4" ]; then
|
||||
|
||||
@@ -140,6 +140,23 @@ if [[ -f "$INSTALL_PATH" ]]; then
|
||||
echo -n "${TAB}Update ${APP}? (y/N): "
|
||||
read -r update_prompt
|
||||
if [[ "${update_prompt,,}" =~ ^(y|yes)$ ]]; then
|
||||
# Older installs kept the public password in the config, which resets it on every start
|
||||
if grep -qE '^\s*adminPassword:\s*"?community-scripts\.org"?\s*$' "$CONFIG_PATH" 2>/dev/null; then
|
||||
msg_info "Replacing the default admin password"
|
||||
ADMIN_PASS=$(random_password 20)
|
||||
sed -i -E "s|^(\s*adminPassword:).*|\1 ${ADMIN_PASS}|" "$CONFIG_PATH"
|
||||
chmod 600 "$CONFIG_PATH"
|
||||
if [[ "$OS" == "Debian" ]]; then systemctl restart filebrowser.service; else rc-service filebrowser restart &>/dev/null; fi
|
||||
fq_port=$(awk '/^http:/{h=1} h && /^ port:/{print $2; exit}' "$CONFIG_PATH")
|
||||
for _ in {1..30}; do
|
||||
[[ "$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${fq_port:-8080}/health")" == "200" ]] && break
|
||||
sleep 1
|
||||
done
|
||||
sed -i '/^\s*adminPassword:/d' "$CONFIG_PATH"
|
||||
echo -e "FileBrowser Quantum\nUsername: admin\nPassword: ${ADMIN_PASS}" >~/filebrowser-quantum.creds
|
||||
chmod 600 ~/filebrowser-quantum.creds
|
||||
msg_ok "Replaced the default admin password (saved in ~/filebrowser-quantum.creds)"
|
||||
fi
|
||||
if check_for_gh_release "filebrowser-quantum" "gtsteffaniak/filebrowser"; then
|
||||
msg_info "Updating ${APP}"
|
||||
if ! command -v curl &>/dev/null; then $STD $PKG_MANAGER curl; fi
|
||||
@@ -189,6 +206,8 @@ chown root:root /usr/local/community-scripts
|
||||
chmod 755 /usr/local/community-scripts
|
||||
msg_ok "Directory prepared"
|
||||
|
||||
ADMIN_PASS=$(random_password 20)
|
||||
msg_warn "FileBrowser runs as root and shows the whole filesystem. Without authentication, anyone who reaches port ${PORT} can read and change every file."
|
||||
echo -n "${TAB}Use No Authentication? (y/N): "
|
||||
read -r noauth_prompt
|
||||
|
||||
@@ -234,9 +253,12 @@ server:
|
||||
- neverWatchPath: "/lost+found"
|
||||
auth:
|
||||
adminUsername: admin
|
||||
adminPassword: community-scripts.org
|
||||
adminPassword: ${ADMIN_PASS}
|
||||
EOF
|
||||
msg_ok "Configured with default admin (admin / community-scripts.org)"
|
||||
chmod 600 "$CONFIG_PATH"
|
||||
echo -e "FileBrowser Quantum\nUsername: admin\nPassword: ${ADMIN_PASS}" >~/filebrowser-quantum.creds
|
||||
chmod 600 ~/filebrowser-quantum.creds
|
||||
msg_ok "Configured admin (credentials saved in ~/filebrowser-quantum.creds)"
|
||||
fi
|
||||
|
||||
msg_info "Creating service"
|
||||
@@ -276,4 +298,13 @@ EOF
|
||||
fi
|
||||
|
||||
msg_ok "Service created successfully"
|
||||
|
||||
# auth.adminPassword resets the password on every start, so it stays only until the admin exists
|
||||
if grep -q '^\s*adminPassword:' "$CONFIG_PATH"; then
|
||||
for _ in {1..30}; do
|
||||
[[ "$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${PORT}/health")" == "200" ]] && break
|
||||
sleep 1
|
||||
done
|
||||
sed -i '/^\s*adminPassword:/d' "$CONFIG_PATH"
|
||||
fi
|
||||
msg_ok "${APP} is reachable at: ${BL}http://${IP}:${PORT}${CL}"
|
||||
|
||||
@@ -87,6 +87,20 @@ if [ -f "$INSTALL_PATH" ]; then
|
||||
|
||||
read -r -p "Would you like to update ${APP}? (y/N): " update_prompt
|
||||
if [[ "${update_prompt,,}" =~ ^(y|yes)$ ]]; then
|
||||
# Older installs created admin with the public password community-scripts.org
|
||||
fb_port=$(grep -oP '(?<=-p )[0-9]+' "$SERVICE_PATH" 2>/dev/null | head -n1)
|
||||
fb_db=$(grep -oP '(?<=-d )\S+' "$SERVICE_PATH" 2>/dev/null | head -n1)
|
||||
[[ -n "$fb_db" ]] || fb_db="$(grep -oP '(?<=^WorkingDirectory=)\S+' "$SERVICE_PATH" 2>/dev/null || echo /root)/filebrowser.db"
|
||||
if [[ "$(curl -s -o /dev/null -w '%{http_code}' -X POST -H 'Content-Type: application/json' -d '{"username":"admin","password":"community-scripts.org","recaptcha":""}' "http://127.0.0.1:${fb_port:-8080}/api/login")" == "200" ]]; then
|
||||
msg_info "Replacing the default admin password"
|
||||
ADMIN_PASS=$(random_password 20)
|
||||
if [[ "$OS" == "Debian" ]]; then systemctl stop filebrowser; else rc-service filebrowser stop &>/dev/null; fi
|
||||
$STD filebrowser users update admin --password "$ADMIN_PASS" --database "$fb_db"
|
||||
if [[ "$OS" == "Debian" ]]; then systemctl start filebrowser; else rc-service filebrowser start &>/dev/null; fi
|
||||
echo -e "FileBrowser\nUsername: admin\nPassword: ${ADMIN_PASS}" >~/filebrowser.creds
|
||||
chmod 600 ~/filebrowser.creds
|
||||
msg_ok "Replaced the default admin password (saved in ~/filebrowser.creds)"
|
||||
fi
|
||||
if check_for_gh_release "filebrowser" "filebrowser/filebrowser"; then
|
||||
msg_info "Updating ${APP}"
|
||||
fetch_and_deploy_gh_release "filebrowser" "filebrowser/filebrowser" "prebuild" "latest" "/opt/filebrowser-dist" "linux-$(arch_resolve)-filebrowser.tar.gz"
|
||||
@@ -125,6 +139,8 @@ if [[ "${install_prompt,,}" =~ ^(y|yes)$ ]]; then
|
||||
chmod 644 "$DB_PATH"
|
||||
msg_ok "Directory created successfully"
|
||||
|
||||
ADMIN_PASS=$(random_password 20)
|
||||
msg_warn "FileBrowser runs as root and shows the whole filesystem. Without authentication, anyone who reaches port ${PORT} can read and change every file."
|
||||
read -r -p "Would you like to use No Authentication? (y/N): " auth_prompt
|
||||
if [[ "${auth_prompt,,}" =~ ^(y|yes)$ ]]; then
|
||||
msg_info "Configuring No Authentication"
|
||||
@@ -133,16 +149,18 @@ if [[ "${install_prompt,,}" =~ ^(y|yes)$ ]]; then
|
||||
$STD filebrowser config set -a '0.0.0.0' -p "$PORT" -d "$DB_PATH"
|
||||
$STD filebrowser config set --auth.method=noauth --database "$DB_PATH"
|
||||
if ! filebrowser users update 1 --perm.admin --database "$DB_PATH" &>/dev/null; then
|
||||
$STD filebrowser users add admin community-scripts.org --perm.admin --database "$DB_PATH"
|
||||
$STD filebrowser users add admin "$ADMIN_PASS" --perm.admin --database "$DB_PATH"
|
||||
fi
|
||||
msg_ok "No Authentication configured"
|
||||
else
|
||||
msg_info "Setting up default authentication"
|
||||
msg_info "Setting up authentication"
|
||||
cd /usr/local/community-scripts
|
||||
$STD filebrowser config init -a '0.0.0.0' -p "$PORT" -d "$DB_PATH"
|
||||
$STD filebrowser config set -a '0.0.0.0' -p "$PORT" -d "$DB_PATH"
|
||||
$STD filebrowser users add admin community-scripts.org --perm.admin --database "$DB_PATH"
|
||||
msg_ok "Default authentication configured (admin:community-scripts.org)"
|
||||
$STD filebrowser users add admin "$ADMIN_PASS" --perm.admin --database "$DB_PATH"
|
||||
echo -e "FileBrowser\nUsername: admin\nPassword: ${ADMIN_PASS}" >~/filebrowser.creds
|
||||
chmod 600 ~/filebrowser.creds
|
||||
msg_ok "Authentication configured (credentials saved in ~/filebrowser.creds)"
|
||||
fi
|
||||
|
||||
msg_info "Creating service"
|
||||
@@ -156,7 +174,6 @@ After=network-online.target
|
||||
User=root
|
||||
WorkingDirectory=/usr/local/community-scripts
|
||||
ExecStartPre=/bin/touch /usr/local/community-scripts/filebrowser.db
|
||||
ExecStartPre=/usr/local/bin/filebrowser config set -a "0.0.0.0" -p ${PORT} -d /usr/local/community-scripts/filebrowser.db
|
||||
ExecStart=/usr/local/bin/filebrowser -r / -d /usr/local/community-scripts/filebrowser.db -p ${PORT}
|
||||
Restart=always
|
||||
|
||||
|
||||
Reference in New Issue
Block a user