SVI/ProxmoxVE
1
0
Fork 0
mirror of https://github.com/community-scripts/ProxmoxVE.git synced 2026-05-12 11:12:15 -04:00
Code Issues 2.6k Packages Projects Releases 10 Wiki Activity

[Security Risk] Home Assistant Container LXC installs unsecured portainer instance on network w/no warning(s) #755

New Issue
Closed
opened 2025-11-20 04:53:27 -05:00 by saavagebueno · 10 comments
saavagebueno commented 2025-11-20 04:53:27 -05:00
Owner
Copy Link

Originally created by @numericOverflow on GitHub (Mar 21, 2025).

✅ Have you read and understood the above guidelines?

Yes

📜 What is the name of the script you are using?

Home Assistant (LXC)

📂 What was the exact command used to execute the script?

bash -c "$(wget -qLO - https://github.com/community-scripts/ProxmoxVE/raw/main/ct/homeassistant.sh)"

📝 Provide a clear and concise description of the issue.

Installing Home Assistant LXC also installs a Portainer instance in that LXC which has no default user/pass configured. The first person to access the instance Portainer webgui can pwn that install as they get to set the admin credentials.

IMO, this seems like a big security risk to leave an open portatiner install on the network . There's no warning(s) to user that portainer now exists and needs to be secured by finishing the portainer setup.

I only happened to find it b/c I copied the wrong URL while trying to open HomeAssistant for the first time.

⚙️ What settings are you using?

  • Default Settings
  • Advanced Settings

🖥️ Which Linux distribution are you using?

Debian 12

🔄 Steps to reproduce the issue.

Run the HA (LXC) install command.
bash -c "$(wget -qLO - https://github.com/community-scripts/ProxmoxVE/raw/main/ct/homeassistant.sh)"

everything from there is automatic.

Visit the HA url shown after install script completes.

Set admin user/pass on that portainer instance.

❌ Paste the full error output (if available).

Not an error, script installed successfully. This is a security risk

To mitigate, I'd suggest any of the following

  1. Do not install portainer.
  2. Not allow portainer to be access outside the LXC (if possible)
  3. Finish the portainer setup and secure it with a proper uers/pass either from user prompt or random generated at install time if user never needs to manage/maintain portainer.

🖼️ Additional context (optional).

Image

Originally created by @numericOverflow on GitHub (Mar 21, 2025). ### ✅ Have you read and understood the above guidelines? Yes ### 📜 What is the name of the script you are using? Home Assistant (LXC) ### 📂 What was the exact command used to execute the script? bash -c "$(wget -qLO - https://github.com/community-scripts/ProxmoxVE/raw/main/ct/homeassistant.sh)" ### 📝 Provide a clear and concise description of the issue. Installing Home Assistant LXC also installs a Portainer instance in that LXC which has no default user/pass configured. The first person to access the instance Portainer webgui can pwn that install as they get to set the admin credentials. IMO, this seems like a big security risk to leave an open portatiner install on the network . There's no warning(s) to user that portainer now exists and needs to be secured by finishing the portainer setup. I only happened to find it b/c I copied the wrong URL while trying to open HomeAssistant for the first time. ### ⚙️ What settings are you using? - [ ] Default Settings - [x] Advanced Settings ### 🖥️ Which Linux distribution are you using? Debian 12 ### 🔄 Steps to reproduce the issue. Run the [HA (LXC)](https://community-scripts.github.io/ProxmoxVE/scripts?id=homeassistant) install command. `bash -c "$(wget -qLO - https://github.com/community-scripts/ProxmoxVE/raw/main/ct/homeassistant.sh)"` everything from there is automatic. Visit the HA url shown after install script completes. Set admin user/pass on that portainer instance. ### ❌ Paste the full error output (if available). Not an error, script installed successfully. This is a security risk To mitigate, I'd suggest any of the following 1. Do not install portainer. 2. Not allow portainer to be access outside the LXC (if possible) 3. Finish the portainer setup and secure it with a proper uers/pass either from user prompt or random generated at install time if user never needs to manage/maintain portainer. ### 🖼️ Additional context (optional). ![Image](https://github.com/user-attachments/assets/d09bd687-3151-46ca-93ad-561efc48c33c)
saavagebueno added the not a script issueinvestigation labels 2025-11-20 04:53:27 -05:00
saavagebueno commented 2025-11-20 04:53:28 -05:00
Author
Owner
Copy Link

@MickLesk commented on GitHub (Mar 21, 2025):

It is impossible to automate this. Portainer Setup only with UI. Basically, this should probably be in the portainer repo, as we have no control over the tool.

If it were, the most we ist to add a note on Website. But surely everyone who installs portainer should also know that it needs to be set up?

@MickLesk commented on GitHub (Mar 21, 2025): It is impossible to automate this. Portainer Setup only with UI. Basically, this should probably be in the portainer repo, as we have no control over the tool. If it were, the most we ist to add a note on Website. But surely everyone who installs portainer should also know that it needs to be set up?
saavagebueno commented 2025-11-20 04:53:28 -05:00
Author
Owner
Copy Link

@tremor021 commented on GitHub (Mar 21, 2025):

Also how the hell someone can "pwn" this? You're the one installing it...

@tremor021 commented on GitHub (Mar 21, 2025): Also how the hell someone can "pwn" this? You're the one installing it...
saavagebueno commented 2025-11-20 04:53:28 -05:00
Author
Owner
Copy Link

@numericOverflow commented on GitHub (Mar 21, 2025):

It is impossible to automate this. Portainer Setup only with UI. Basically, this should probably be in the portainer repo, as we have no control over the tool.

If it were, the most we ist to add a note on Website. But surely everyone who installs portainer should also know that it needs to be set up?

@MickLesk - True, if I set out to install Portainer, I would absolutely know to go secure it. I wasn't expecting portainer to be installed so that's the issue, IMO.

I guess the unexpected nesting of LXC->Portainer->Docker container is really what I see as the problem. I get it, HA is distributed as a docker image which necessitates portainer, but at least tell the users they are responsible to go secure the newly installed dependency.

There's often tons of dependencies installed when a app or container is setup, but I think the general expectation is that you should only need to configure the main application you're installing (in this case Home Assistant) and not necessarily go secure each & every dependency (Portainer) unless explicitly told you must do so.

A note on the website as well as notice when the install script completes would be a decent start as there's nothing suggesting that portainer is installed unless you closely watch the actual install steps.

  • Maybe a solution would be to add a firewall rule during install to block any access to port 9443 of the nested portainer instance so it can't be configured/accessed by anyone outside the LXC?

Also how the hell someone can "pwn" this? You're the one installing it...

@tremor021 - If someone finds the unconfigured portainer UI, they can do anything they want to the HA setup where there is a TON of sensitive info within HA. They just complete the portainer setup with any user/pass they want and bingo. This feels pretty "pwn" to me...

Image

@numericOverflow commented on GitHub (Mar 21, 2025): > It is impossible to automate this. Portainer Setup only with UI. Basically, this should probably be in the portainer repo, as we have no control over the tool. > > If it were, the most we ist to add a note on Website. But surely everyone who installs portainer should also know that it needs to be set up? @MickLesk - True, if I set out to install Portainer, I would absolutely know to go secure it. I wasn't expecting portainer to be installed so that's the issue, IMO. I guess the unexpected nesting of LXC->Portainer->Docker container is really what I see as the problem. I get it, HA is distributed as a docker image which necessitates portainer, but at least tell the users they are responsible to go secure the newly installed dependency. There's often tons of dependencies installed when a app or container is setup, but I think the general expectation is that you should only need to configure the main application you're installing (in this case Home Assistant) and not necessarily go secure each & every dependency (Portainer) unless **explicitly told you must do so**. A note on the website as well as notice when the install script completes would be a decent start as there's nothing suggesting that portainer is installed unless you closely watch the actual install steps. - [ ] Maybe a solution would be to add a firewall rule during install to block any access to port 9443 of the nested portainer instance so it can't be configured/accessed by anyone outside the LXC? > Also how the hell someone can "pwn" this? You're the one installing it... @tremor021 - If someone finds the unconfigured portainer UI, they can do anything they want to the HA setup where there is a TON of sensitive info within HA. They just complete the portainer setup with any user/pass they want and bingo. This feels pretty "pwn" to me... ![Image](https://github.com/user-attachments/assets/ca9bf9c9-031b-4c21-9940-e0ab71429e1f)
saavagebueno commented 2025-11-20 04:53:29 -05:00
Author
Owner
Copy Link

@numericOverflow commented on GitHub (Mar 21, 2025):

BTW - don't me wrong, these scripts are great and I absolutely love the work. I'm just reporting what I see as a security hole with the hope to make it better in the end :)

@numericOverflow commented on GitHub (Mar 21, 2025): BTW - don't me wrong, these scripts are great and I absolutely love the work. I'm just reporting what I see as a security hole with the hope to make it better in the end :)
saavagebueno commented 2025-11-20 04:53:29 -05:00
Author
Owner
Copy Link

@tremor021 commented on GitHub (Mar 21, 2025):

@numericOverflow thats not how it works. Portainer has 5 minute timeout for you to enter new user. If you fail, it shuts down the container

@tremor021 commented on GitHub (Mar 21, 2025): @numericOverflow thats not how it works. Portainer has 5 minute timeout for you to enter new user. If you fail, it shuts down the container
saavagebueno commented 2025-11-20 04:53:29 -05:00
Author
Owner
Copy Link

@numericOverflow commented on GitHub (Mar 21, 2025):

Right, but it

@numericOverflow thats not how it works. Portainer has 5 minute timeout for you to enter new user. If you fail, it shuts down the container

Right, but from my testing, that configuration timeout window reopens every time I restart the container.

@numericOverflow commented on GitHub (Mar 21, 2025): Right, but it > [@numericOverflow](https://github.com/numericOverflow) thats not how it works. Portainer has 5 minute timeout for you to enter new user. If you fail, it shuts down the container Right, but from my testing, that configuration timeout window reopens every time I restart the container.
saavagebueno commented 2025-11-20 04:53:29 -05:00
Author
Owner
Copy Link

@tremor021 commented on GitHub (Mar 21, 2025):

@numericOverflow Correct. After you restart Portainer, you get a chance to enter user/pass again for 5 minutes. If the guy attacking you has power to start a container on your host, then i'm afraid you have bigger problems than Portainer.

@tremor021 commented on GitHub (Mar 21, 2025): @numericOverflow Correct. After you restart Portainer, you get a chance to enter user/pass again for 5 minutes. If the guy attacking you has power to start a container on your host, then i'm afraid you have bigger problems than Portainer.
saavagebueno commented 2025-11-20 04:53:29 -05:00
Author
Owner
Copy Link

@Mati-l33t commented on GitHub (Mar 21, 2025):

Are you not already pwned if someone have access to your LAN?

@Mati-l33t commented on GitHub (Mar 21, 2025): Are you not already pwned if someone have access to your LAN?
saavagebueno commented 2025-11-20 04:53:30 -05:00
Author
Owner
Copy Link

@numericOverflow commented on GitHub (Mar 22, 2025):

OK, let me frame this another way:

  • Why is portainer bundled with HomeAssistant by default,? Shouldn't docker alone be enough to run HA and portainer is just an optional add-on?

Wouldn't it be better if we just ask the user if they actually want portainer, and only install it if they say yes?

That's looks like the strategy the docker LXC install script takes

@numericOverflow commented on GitHub (Mar 22, 2025): OK, let me frame this another way: - [ ] **_Why is portainer bundled with HomeAssistant by default,?_** Shouldn't docker alone be enough to run HA and portainer is just an optional add-on? Wouldn't it be better if we just ask the user if they actually want portainer, and only install it if they say yes? That's looks like the strategy the [docker LXC install script takes](https://github.com/community-scripts/ProxmoxVE/blob/933d3731cfd05c2f0eab9bddbc0ea1feb50e5b31/install/docker-install.sh#L38)
saavagebueno commented 2025-11-20 04:53:30 -05:00
Author
Owner
Copy Link

@MickLesk commented on GitHub (Mar 31, 2025):

We do not change the logic of stock scripts to this extent. Portainer is fixed there, therefore no optional question necessary / useful.

As already explained, Portainer loses the option to store a user password there after 5 minutes, until the next restart.

I have added the information on the website accordingly. But in the end, if someone is in your network within 5 minutes, they certainly have better things to do than bashing Portainer with HomeAssistant :-D

@MickLesk commented on GitHub (Mar 31, 2025): We do not change the logic of stock scripts to this extent. Portainer is fixed there, therefore no optional question necessary / useful. As already explained, Portainer loses the option to store a user password there after 5 minutes, until the next restart. I have added the information on the website accordingly. But in the end, if someone is in your network within 5 minutes, they certainly have better things to do than bashing Portainer with HomeAssistant :-D
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
🛑 Failure to comply with the guidelines
breaking change
bug
bug
bugfix
deferred
delete script
dependencies
enhancement
external
feature
github
help wanted
Implemented in VED waiting push to Main
in project pipeline
invalid
investigation
json
maintenance
new script
new script
nice to have
not a script issue
not planned
organization
pull-request
Mirrored from GitHub Pull Request
 question
refactor
rename script
security
update script
website
wontdo
No Label investigation not a script issue
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/ProxmoxVE#755
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?