I noticed this when running tests recently on some client sites:

UID #1 access - Determine if UID #1 is blocked.

  • UID #1 not blocked.

The above section shows as green with 100%:

Well done! No action required

That's backwards behaviour, IMHO. Superuser access should always be blocked. Real users and permission sets (roles) should be used instead to ensure accountability, and reduce the security risk of having the account accessible. See Securing user #1 for details.

Thoughts?

CommentFileSizeAuthor
#6 uid_1_block-3020631-6.patch1.43 KBwaverate

Comments

colan created an issue. See original summary.

fluxsauce’s picture

fluxsauce commented

A little context, that was written back in 2013 and at the time we/Pantheon recommended that. Times change and it makes sense to update the recommendation to align with current best practices.

kreynen’s picture

kreynen commented

+1 for reversing this logic, but until then is there a way to configure Site Audit on Pantheon to ignore this test?

colan’s picture

colan
he/him
Primary language English
Location Toronto 🇨🇦
commented

#3: I'd recommend writing a patch for this issue (or getting someone else to do it). Once it's merged, you can ask Pantheon to upgrade their copy of the module to the latest release here.

Or better yet, run Aegir instead so you can change it yourself. ;)

waverate’s picture

waverate commented

I think all that is required is to flip the logic:

27c27
<     return $this->t('UID #1 is not blocked!');
---
>     return $this->t('UID #1 is blocked!');
39c39
<     return $this->t('UID #1 is blocked.');
---
>     return $this->t('UID #1 not blocked.');
52c52
<       return $this->t('Block UID #1');
---
>       return $this->t('Unblock UID #1');
65c65
<       return SiteAuditCheckBase::AUDIT_CHECK_SCORE_PASS;
---
>       return SiteAuditCheckBase::AUDIT_CHECK_SCORE_FAIL;
67c67
<     return SiteAuditCheckBase::AUDIT_CHECK_SCORE_FAIL;
---
>     return SiteAuditCheckBase::AUDIT_CHECK_SCORE_PASS;
waverate’s picture

waverate commented
Status: Active » Needs review
StatusFileSize
new uid_1_block-3020631-6.patch1.43 KB

Patch attached.

  • jrglasgow committed ace98d6 on 8.x-3.x authored by waverate 
    Issue #3020631 by waverate: UID #1 should be blocked, not unblocked
jrglasgow’s picture

jrglasgow commented
Status: Needs review » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.