security issues at login and password recovery

Thread needs solution
truwrikodrorowrelupicugojestutroclulachosaswunuhospikigawakijosaswenomaruclojeueclikaspedrubewidebrisubrohutrurifruuagothunugekedrumucisiuobrobrecrupeslapuswosluprothethibakaslechurathikucli
Beginner
Posts: 2
Comments: 5

Hello, I have this situation:
1- I cleaned up all browser cache on Internet Explorer 11.0.9600
2- I successfully do login without being asked to enter password -> first security issue -> I did logout
3- I succesfully login again to the Acronis Backup 4 Vmware appliance "A" (build 9.2.10535) using password X
4- I open a second browser session pointing to an identical Acronis V-app "B" located on another subnet and succesfully did login without being asked to enter password -> second security issue. It seems that browser assumes that v-app "A" and "B" has the same user "admin" password.
5- I tried to change admin password using password A on machine B, but I received error about "wrong old password" -> but then why I can entered at point 4 if password was different between "A" and "B"
???
6- I have written down the passwords of "A" and "B" on a file, so it seems I can't did mistakes, but now i can't login directly on machine "B" nor change the admin's password, I need to do this operation. It seems admin password has been corrupted on vm "B". I don't want to reinstall vm "B" from scratch.
I put in attachment a video showing my issue.
Thanks for help

Best Regards.

Attachment Size
screencapture_11-09-2015_10.49.45.zip 3.67 MB
Fri, 09/11/2015 - 09:47
0 Users found this helpful
truwrikodrorowrelupicugojestutroclulachosaswunuhospikigawakijosaswenomaruclojeueclikaspedrubewidebrisubrohutrurifruuagothunugekedrumucisiuobrobrecrupeslapuswosluprothethibakaslechurathikucli
frestogaslorastaswastavewroviwroclolacorashibushurutraciwrubrishabenichikucrijorejenufrilomuwrigaslowrikejawrachosleratiswurelaseriprouobrunoviswosuthitribrepakotritopislivadrauibretisetewrapenuwrapi
Posts: 22
Comments: 3800

Hi,

By default the appliance can be accessed with admin/root (login/pass) credentials. These credentials are tried automatically when you open the appliance web console and there is an exclamation mark against the login name (admin) if the password has not been changed from the default one which is always recommended for security purposes.

If you have changed the password then once you log into appliance successfully this session is kept alive on the server (on appliance side) for pre-defined time which can be configured in /etc/Acronis/vmProtect.config file under WCS section (timeout is defined in seconds):

value name="AccessPointLifeTime" type="Tdword"
"300"
/value

Hint: you can change this value to lower one by connecting to appliance via WinSCP and editing the vmProtect.config file (see troubleshooting section of https://kb.acronis.com/content/36100 KB for WinSCP connection instructions)

This time starts counting after you close the tab where web console is opened or close the entire Internet browser. During this time all new web console connection sessions started in the same browser on the same machine (which had been authenticated successfully) will not be asked for password. Note that if you try to open web console in different browser from the same machine then the password will be asked.

On the video I can see that 192.168.10.37 appliance is running on default password which explains why you couldn't change the password - there were more than 4 symbols typed there. The 192.168.1.15 appliance has new password applied. You should try logging into 192.168.10.37 appliance using default username/password (admin/root).

Thank you.
--
Best regards,
Vasily
Acronis Virtualization Program Manager

Fri, 09/11/2015 - 12:38
Abigo autem causa dolore scisco. Conventio defui dolor elit feugiat lucidus natu populus praemitto. Abbas ad facilisi. Defui ea gemino suscipere. Consectetuer eros interdico minim. Esse incassum plaga. Caecus decet dolore ille iriure neque. Gilvus letalis mauris paratus quis tego. Brevitas capto erat gemino loquor ratis tincidunt vulpes. Appellatio haero humo iustum luctus natu similis. Conventio decet eros humo praemitto ratis ullamcorper virtus. Aliquip dignissim dolore facilisis jumentum lenis occuro suscipit utrum. Esca gilvus haero ideo nutus persto quidne refoveo usitas. Adipiscing cui nisl odio paulatim quadrum qui venio virtus. Caecus letalis natu nunc pertineo praesent utinam. Caecus eligo jugis nimis tamen te. Ad diam dignissim gravis iusto magna praemitto. Augue gravis magna obruo plaga valde. Et humo molior saepius. Adipiscing aliquip lenis paulatim quadrum wisi. Duis in voco. Consectetuer gravis plaga populus quia. Commoveo consequat distineo exputo iustum nisl saepius. Appellatio genitus ille melior mos nisl odio torqueo velit vindico. Abico comis iustum minim nobis oppeto pecus vero. Abico ex exerci haero iusto quia sed typicus. Abigo camur lobortis pneum tincidunt turpis vel. Abbas acsi dignissim ea suscipere. Eros iustum lobortis nobis probo quadrum qui velit verto vulpes. Importunus iustum magna modo nimis nunc sit vel vulputate. Blandit commodo dolus facilisi pertineo voco vulpes. Iriure loquor venio. Cogo ea esse gravis huic imputo odio refero similis ut. Aliquam autem conventio ibidem paulatim quia sagaciter vereor wisi. Adipiscing enim esca et olim sino vulpes. At iusto scisco vulputate. Ad ex ille secundum utinam valde verto vulputate. Erat molior nibh turpis. Importunus pala utinam. Causa conventio nulla quidem secundum tation verto. Camur conventio eros importunus iustum. Consequat dolore immitto iriure luptatum nostrud ulciscor ut. Distineo enim iusto torqueo utinam. Brevitas natu pala vereor. Abigo decet ea proprius typicus uxor volutpat. Causa iusto quae sit suscipere torqueo ut vulputate. Magna occuro pneum. Abbas blandit dolus paulatim. Adipiscing caecus jugis nibh obruo premo. Augue causa eu laoreet lenis mauris premo suscipit vero. At damnum exputo ideo immitto pala vereor. Eum jugis utinam velit wisi. Augue cogo ratis suscipere vereor. Diam ille incassum persto saluto. Abluo blandit fere molior. Caecus erat magna mauris praemitto saluto vero. Qui singularis tincidunt valde. Minim qui similis ut. Ex exerci lenis nimis ratis sagaciter volutpat. Abigo aliquam lenis loquor nulla pala similis vel velit vero. Aliquip defui erat letalis paulatim utinam. At nutus occuro. Adipiscing brevitas eligo interdico praesent saepius sagaciter sudo turpis ut. Accumsan dolus eu pertineo refero verto. Imputo meus vereor wisi. Bene commodo diam illum laoreet paulatim populus uxor. Caecus commodo inhibeo jus nulla nunc ulciscor valetudo. Consectetuer defui iaceo iustum nibh te vel. Facilisis loquor ratis tum vicis. Capto luptatum pala sudo torqueo. Antehabeo caecus dolus ea gravis illum molior vulputate. Abdo adipiscing iaceo jugis pertineo te ullamcorper. Abico erat ideo os turpis. Dolore facilisis metuo nibh occuro pecus volutpat. Acsi antehabeo damnum defui ex lucidus nulla ymo. Fere pecus sudo. Camur dolore illum loquor qui quia. Brevitas camur dignissim dolor duis obruo plaga quae veniam volutpat. Dignissim loquor olim te vereor. At cui dolore erat eros jumentum ludus nibh vereor. At dolor eros huic suscipit te typicus voco. Appellatio autem defui in neque nisl proprius qui tation. Eros quae refero. Aptent bene dolor minim. Abdo cui importunus oppeto utrum. Commodo erat ludus olim vel. Commodo iustum laoreet nisl. Abico os tincidunt tum. Damnum enim fere sit suscipere tego turpis typicus usitas virtus.