io7m | single-page | multi-page | epub | Idstore User Manual 1.0.0-beta0010
9.3. General
Previous
9. Security
Up
9.5. User API
Next

# 9.4. Admin API

- 9.4.1. Trust
- 9.4.2. Possible Attack: Privilege Escalation
  - 9.4.2.1. Description
  - 9.4.2.2. Mitigation
- 9.4.3. Possible Attack: Privilege Escalation By Password
  - 9.4.3.1. Description
  - 9.4.3.2. Mitigation

## 9.4.1. Trust

1
Administrators enjoy a somewhat higher level of trust in the idstore server; they are typically expected to be actual members of whatever organization happens to be running the server. This documentation, therefore, does not attempt to cover all the ways a privileged administrator could damage a running system. Administrators are individually subject to a fine-grained capability-based security policy, so administrators should be granted the minimum privileges needed to do their jobs.

## 9.4.2. Possible Attack: Privilege Escalation

## 9.4.2.1. Description

1
A malicious administrator could attempt to grant themselves more permissions than they currently have.

## 9.4.2.2. Mitigation

1
The idstore server has a hard-coded security policy that states that an arbitrary administrator Z must first have the ADMIN_WRITE_PERMISSIONS_SELF permission to modify itself. Assuming Z passes this check, the security policy then states that, for any administrators X and Y, the only permissions X can grant to Y is the set of permissions held by X. As, X = Y = Z, Z cannot grant any new permissions it does not have to itself.

## 9.4.3. Possible Attack: Privilege Escalation By Password

## 9.4.3.1. Description

1
A malicious administrator could effectively grant themselves more permissions than they currently have by accessing the hashed password of another administrator. By getting access to an account with sufficient privileges, the administrator could use the compromised account to grant their existing account more permissions.

## 9.4.3.2. Mitigation

1
The only way to retrieve the complete account details of an administrator is using the IdACommandAdminGet command internally. The code that processes the IdACommandAdminGet command redacts the password of any administrator that passes through it; it is not even possible for an administrator to obtain their own hashed password. The system never stores plain-text passwords in any form.
2
An administrator could attempt to guess the password of the initial administrator. There is no mitigation against this; set a very strong password and do not use that account for regular operations.
9.3. General
Previous
9. Security
Up
9.5. User API
Next
io7m | single-page | multi-page | epub | Idstore User Manual 1.0.0-beta0010