{"action":"created","issue":{"url":"https://api.github.com/repos/pydio/pydio-sync/issues/78","labels_url":"https://api.github.com/repos/pydio/pydio-sync/issues/78/labels{/name}","comments_url":"https://api.github.com/repos/pydio/pydio-sync/issues/78/comments","events_url":"https://api.github.com/repos/pydio/pydio-sync/issues/78/events","html_url":"https://github.com/pydio/pydio-sync/issues/78","id":53978472,"number":78,"title":"Settings not separated by client computer user account on OSX","user":{"login":"alexmbaker","id":2808984,"avatar_url":"https://avatars.githubusercontent.com/u/2808984?v=3","gravatar_id":"","url":"https://api.github.com/users/alexmbaker","html_url":"https://github.com/alexmbaker","followers_url":"https://api.github.com/users/alexmbaker/followers","following_url":"https://api.github.com/users/alexmbaker/following{/other_user}","gists_url":"https://api.github.com/users/alexmbaker/gists{/gist_id}","starred_url":"https://api.github.com/users/alexmbaker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexmbaker/subscriptions","organizations_url":"https://api.github.com/users/alexmbaker/orgs","repos_url":"https://api.github.com/users/alexmbaker/repos","events_url":"https://api.github.com/users/alexmbaker/events{/privacy}","received_events_url":"https://api.github.com/users/alexmbaker/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-01-11T01:47:56Z","updated_at":"2015-02-09T11:01:37Z","closed_at":null,"body":"It is possible that the issue described below is partially an result of a whole series of errors making it difficult to know if i am reporting the true issue or simply observing symptomatic effects of some other problem.  If someone could let me know how I can delete all local configuration data using bash or finder I will happily run the tests again and provide a more detailed description and screen shots.\r\n\r\n\r\n# Environment\r\n\r\nServer = Pydio 6.0.2 on Ubuntu Server 14.04 LTS, Apache2\r\nClient = Mac OSX Yosemite, unknown client version as the \"About\" menu does not work\r\n\r\nClient computer has 2 user accounts, Alex and Jodie\r\n\r\n# Steps to reproduce \r\n\r\n* Start Computer\r\n* Log in as Alex\r\n* Switch users and Log in as Jodie\r\n* Download and install the latest pydio-sync client taken from website 11 Jan 2015\r\n* Configure Client to connect to server and synchronise whole workspace\r\n* Switch users back to Alex\r\n\r\n# Expected Results\r\n\r\n* Pydio Client under user Alex should not show Jodie's configuration\r\n* Pydio Client should not default to synchronise to user Alex's Pydio directory in Alex's home folder\r\n\r\n# Actual Results\r\n\r\n* Pydio Client shows 3 synchronisation profiles under both user accounts\r\n* When user Jodie was creating the synchronisation profile the pre-selected folder to synchronise data was /Users/alex/Pydio\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/pydio/pydio-sync/issues/comments/73491051","html_url":"https://github.com/pydio/pydio-sync/issues/78#issuecomment-73491051","issue_url":"https://api.github.com/repos/pydio/pydio-sync/issues/78","id":73491051,"user":{"login":"Flauschbaellchen","id":2529271,"avatar_url":"https://avatars.githubusercontent.com/u/2529271?v=3","gravatar_id":"","url":"https://api.github.com/users/Flauschbaellchen","html_url":"https://github.com/Flauschbaellchen","followers_url":"https://api.github.com/users/Flauschbaellchen/followers","following_url":"https://api.github.com/users/Flauschbaellchen/following{/other_user}","gists_url":"https://api.github.com/users/Flauschbaellchen/gists{/gist_id}","starred_url":"https://api.github.com/users/Flauschbaellchen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Flauschbaellchen/subscriptions","organizations_url":"https://api.github.com/users/Flauschbaellchen/orgs","repos_url":"https://api.github.com/users/Flauschbaellchen/repos","events_url":"https://api.github.com/users/Flauschbaellchen/events{/privacy}","received_events_url":"https://api.github.com/users/Flauschbaellchen/received_events","type":"User","site_admin":false},"created_at":"2015-02-09T11:01:37Z","updated_at":"2015-02-09T11:01:37Z","body":"@alexmbaker, I found the same issue and as it seems it is a general one for all OS.\r\nI reported it (https://pyd.io/f/topic/client-security-in-multi-user-environments) but as the forum is not fully visible to guests I quote it here:\r\n\r\nMyself (Noxx), February 6, 2015 at 12:06 pm\r\n>Hi there,\r\n\r\n>I just played a bit around with the new pydio client (v6, Linux/Ubuntu) prior to rolling it out to all my client computers.\r\n>Please correct me if I’m wrong but as far as I’ve found out:\r\n\r\n>The client is just a simple browser layer.\r\n>It opens the frontend of the agent which runs in the background.\r\n>The configuration on this agent is not user-based, thus in an multi-user environment each user can see all configured shares another user set up.\r\n>But not enough, it’s also possible to edit and delete these shares.\r\n>Additionally, if an user has only shell access, it is possible to forward the agent’s port to its own computer and access the frontend there.\r\n\r\n>All in all, it’s a security nightmare.\r\n\r\n>Any plans on restict/fix this?\r\n>Or is there another configuration setting I didn’t found yet?\r\n\r\n>Greetings~\r\n\r\nCharles, February 6, 2015 at 3:07 pm\r\n>Hi Noxx,\r\n>to make it short:\r\n>. You’ve understood well the architecture (daemon + UI).\r\n>. Indeed it’s not multi-user yet: the agent starts under a given user, so if you switch users, it does not restart with the other user home. This is something we are working on, quite complicated as it is very os-specific.\r\n>. About the security concern, if one has access to a shell and ability to forward ports, one has probably the ability to modify a config file on the client machine. That said, the daemon should in any case only allow localhost connection. But maybe I’m wrong, would be glad if you elaborate.\r\n>-c\r\n\r\n\r\nMyself (Noxx), February 9, 2015 at 9:09 am\r\n>Hi charles,\r\n\r\n>thanks for the fast answer.\r\n\r\n>You don’t need any special perms to forward ports if you have shell access.\r\n>I run the test with: “ssh user@maschine -L 5556:localhost:5556″\r\n>Afterwards you can access the remote agent at the same port on your machine as it runs on the remote one.\r\n>On the remote side it looks like a local connection, thus a “listen-only-to-localhost” does not restrict this access.\r\n\r\n>I’ve just tested it on a windows machine.. obviously it suffers from the same issue.\r\n>It’s possible to access the pydio agent from a temporary guest account, too.\r\n\r\n>Because you have access to the *complete* agent configuration, it’s easy to change the destination path of a sync or the workspace it’s working on.\r\n>THIS HAS A CRITICAL SECURITY IMPACT! as it gives any user full access to all files and folders of the original user!\r\n\r\n>The current setup and the idea to run it as a webservice is a nice idea, but as far as I can think it’s totally flawed.\r\n>I don’t see an easy solution to restrict a global running service listening on a port everyone can connect to to a single user.\r\n>Additionally, even if you could, you cannot hardcode the port as it would not allow to run multiple instances of the agent (one for every user).\r\n>If you leave it in the current state allowing it to serve multiple users, it would need a seperate login page and to start as root as it would need the permissions to write files to every user’s home directories (and that would be a negative point, too)\r\n\r\n>Is it possible to get a roughly estimation, if and when this issue can be resolved – or what priority it has?\r\n>I would like to use pydio in a production environment but currently it’s not usable.\r\n>And (the client) should not even be distributed in this state.\r\n\r\n>Sorry if my words seems a bit harsh.\r\n>If you need any further information, feel free to ask.\r\n\r\n>Greetings, Noxx"}}