ProxmoxVE

mirror of https://github.com/community-scripts/ProxmoxVE.git synced 2026-11-09 23:12:53 +01:00

Author	SHA1	Message	Date
MickLesk	80183b1e9e	fix: generate first logins and secrets instead of fixed ones in 13 more installs authelia, qbittorrent, rabbitmq, nagios, neko, paymenter, nodebb, homelable, snapotter and octoprint's Linux user were created with fixed passwords; each now uses random_password and saves the login in ~/<app>.creds. Stirling-PDF no longer sets admin/stirling explicitly, so its own default asks for a new password on first login again. Firefly kept the example APP_KEY and STATIC_CRON_TOKEN, and SigNoz used the JWT secret "secret"; both are generated now. Only new installs change.	2026-11-09 15:39:04 +01:00
MickLesk	fdace325ad	fix: generate the webmin, code-server and copyparty logins; leave existing installs alone webmin set root/root, coder-code-server ran without authentication as root on 0.0.0.0:8680, and copyparty took community-scripts.org when the password prompt was left empty. New installs now get a random password in ~/<app>.creds. The filebrowser and quantum updates no longer touch existing installs, and the FileBrowser database is no longer world-readable.	2026-11-09 15:36:10 +01:00
MickLesk	db2721208a	fix: generate the admin password in monica, archivebox, kimai, npmplus, keycloak, photoprism These installs created their first admin with a public password (community-scripts.org, admin123 or changeme). Each now uses random_password and saves the login in ~/<app>.creds. The Keycloak unit, which carries the bootstrap admin, is no longer world-readable.	2026-11-09 15:16:43 +01:00
MickLesk	77853ffe37	fix(filebrowser): generate the admin password instead of a public one The addon, filebrowser-quantum and the FileBrowser option of homeassistant and podman-homeassistant created admin with the password community-scripts.org, on a service that runs as root over the whole filesystem. A new install now gets a random password in ~/filebrowser.creds or ~/filebrowser-quantum.creds, and an update replaces the public password on existing installs. Quantum only keeps adminPassword in its config until the admin exists, since it resets the password on every start. The Home Assistant options run the addon instead of their own copy pinned to FileBrowser 2.23.0, the service no longer forces the listen address back to 0.0.0.0, and the no-authentication prompt says what it exposes.	2026-11-09 15:15:09 +01:00

1 changed files with 0 additions and 1 deletions

									
										CHANGELOG.md
									
		-1
	
												View File
												
				@@ -597,7 +597,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

				  - #### 🔧 Refactor

				    - security: remove hardcoded credentials in several scripts [@MickLesk](https://github.com/MickLesk) ([#18572](https://github.com/community-scripts/ProxmoxVE/pull/18572))

				    - yuvomi: install from the attested release asset [@ulsklyc](https://github.com/ulsklyc) ([#18554](https://github.com/community-scripts/ProxmoxVE/pull/18554))

				### 🗑️ Deleted Scripts

Compare commits

4 Commits

github-action-update-changelog .. fix/no-hardcoded-credentials

Compare commits

4 Commits github-action-update-changelog .. fix/no-hardcoded-credentials

4 Commits

github-action-update-changelog .. fix/no-hardcoded-credentials