HS network and application security

[zguy]

This is more directed to HomeSeer developers. It may sound like a rant, but it is not. It's more a plea to HomeSeer to adopt better practices. Security is important in network applications.

HS3Pro has some security related options like building a users list with different accesses like guest, normal and admin. It also has an option called: "No Password Required for Local/Same Network Login (Web Browser/HSTouch)", along with a few others.

With this, my guess is developers are somewhat security inclined, which makes sense with an application that controls various functionalities in your house and can possibly be accessible from the net.

So why is it that 2 of the most common tools used with HS, namely Speaker and Z-Tool, require you to lower your security settings below an acceptable standard?

The issue with Speaker stems from the fact it must be used along with the so called user 'default'. In my systems, such a user, known from the entire planet, normally gets deactivated if not deleted. I initially set it to 'No Access' as I didn't have the need for it.

This is when I started getting the error "Speaker host connection refused from 127.0.0.1 User: default User does not exist, does not have adequate rights, or the password is incorrect."

So I created a user specifically for that with normal + local access, set the HS-Touch user properties to that user and then updated the user in the Speaker client config.

That worked for local speaker Client access. But I was still getting the default user error in the log. Moved to configure the Speaker client on another machine on the network. This time I had to up the speaker user access to admin + local for it to connect and some what work (I have another issue with that I will post in another thread). At this point, I'm now getting the default user error twice in the log, 1 for the HS machine and one for the workstation.

The only way to clear the error from the log is to use the default user within HS Touch and the speaker clients.

In my book, this is a security flaw that needs to be addressed. Even if you can change the default user password.

For the Z-tool mobile app, it's a different issue.

When it detects your HomeSeer IP, the message from the Android version is rather clear: "Permission denied at HomeSeer, make sure 'No Password Required for Local Network Login' is checked in HomeSeer setup: Response status code does not indicate success: 401()."

The Apple IOS app is not so friendly though. It just says: "Error GetInterfacesList Response status code does not indicate success: 401()."
Try to figure out what's going on now...

Again, why an external tool forces us to lower our security? I thought I'd found an easier way to manage z-wave devices. Apparently not, because I won't bend on this one and lower my network security. Everything on my network requires a user/password to connect to it.

HS Touch uses a stored user/password to access. Why not make the other tools do the same? It's not that hard to prompt for that information and ensure a minimum of security.

[jon00]

Only HST will be able to answer your question, however FYI, you will not be able to run any remote plugins on your network if you remove/change the default user/password.

[mikaluch]

What? I haven't done much with speech or anything with remote plugins yet but those are next on the list of things to do. The very first step in the HS3 Quick Start Guide is to change the default user password. It doesn't mention that will cripple important capabilities.

You can't run a server system with an admin user named default with a password of default.

[Pete]

The issue with Speaker stems from the fact it must be used along with the so called user 'default'.

The very first step in the HS3 Quick Start Guide is to change the default user password. It doesn't mention that will cripple important capabilities.

I did the doo and it doesn't cripple important capabilities.

Here run two instances of speaker dot exe on a remote Wintel Server VM for two different SAPI voices coming from two HS3 boxes. Each speaker instance is using a unique user name and password on each of the two motherships (HS3 Pro and HS3 ZeeLite).

On the 16 Homeseer touchscreens running in embedded Wintel I do the same with the HSTouch client and HS Speaker application. Works fine and the 16 clients speak in in a variety of english fonts, portuguese SAPI fonts, French, spanish, italian, german et al with no issues.

I have disabled the default user name and password on the two machines. I am currently running the Z-Wave, X-10 and UPB plugins remotely only using the IP of the mothership. IE: mono zwaveplugin.exe server=ipofmothership.

Well Homeseer touch, Homeseer designer and Homeseer speaker all work exactly the same with whatever username and password I configure on them. Remote plugins do not require a username and password from what I can tell here.

Total tally of remote stuff talking to HS3 is: 16 HSTouch clients + 18 speaker clients + 3 remote plugin clients here with no issues.

I utilize Jon00's remote plugin to manage the touchscreens via an event that turns off or on the displays, screen savers or audio; works great. Over did it a bit initially spoofing the MAC addresses to match the IP addresses and DNS names. Lately just got an NIC Eprom burner and burned the MAC address instead in to the ROM NIC chips. IE: so with Jon00's program the last two digits of the clients all match now. Easier for me now to know the devices by mac address rather than network address.

[Rupp]

The speaker client can use any admin account created by you. Default should be disabled once you are up and running.

[zguy]

What? I haven't done much with speech or anything with remote plugins yet but those are next on the list of things to do. The very first step in the HS3 Quick Start Guide is to change the default user password. It doesn't mention that will cripple important capabilities.

You can't run a server system with an admin user named default with a password of default.

You can change the 'default' user password. And it will work as long as you put the same password in the HS Touch setting screen in HS as well as the speaker.exe client configuration.

My point was that you MUST use the user named 'default' to get rid of the log cluttering error message "Speaker host connection refused from 127.0.0.1 User: default User does not exist, does not have adequate rights, or the password is incorrect." and that using a worldwide known user name, even when changing the password, is against best security practices.

HS Touch doesn't have this problem. You can use any valid users configured.

[zguy]

The issue with Speaker stems from the fact it must be used along with the so called user 'default'.

The very first step in the HS3 Quick Start Guide is to change the default user password. It doesn't mention that will cripple important capabilities.

I did the doo and it doesn't cripple important capabilities.

Here run two instances of speaker dot exe on a remote Wintel Server VM for two different SAPI voices coming from two HS3 boxes. Each speaker instance is using a unique user name and password on each of the two motherships (HS3 Pro and HS3 ZeeLite).

On the 16 Homeseer touchscreens running in embedded Wintel I do the same with the HSTouch client and HS Speaker application. Works fine and the 16 clients speak in in a variety of english fonts, portuguese SAPI fonts, French, spanish, italian, german et al with no issues.

I have disabled the default user name and password on the two machines. I am currently running the Z-Wave, X-10 and UPB plugins remotely only using the IP of the mothership. IE: mono zwaveplugin.exe server=ipofmothership.

Well Homeseer touch, Homeseer designer and Homeseer speaker all work exactly the same with whatever username and password I configure on them. Remote plugins do not require a username and password from what I can tell here.

Total tally of remote stuff talking to HS3 is: 16 HSTouch clients + 18 speaker clients + 3 remote plugin clients here with no issues.

And you don't get this error in the HS log:
"Speaker host connection refused from 127.0.0.1 User: default User does not exist, does not have adequate rights, or the password is incorrect."

[Pete]

No cuz I change the iNI file for each speaker client before running it and after I have deleted the default user name and password.

That said I would see that error if there is no default user/password defined.

So yeah it doesn't run and yeah the logs state there is no default user/password defined.

It isn't really crippling the software though, just telling you to enable a new username and password.

I am biased a bit though running HS since 1998 which truthfully doesn't help the newbie Homeseer person.

Cuz I really don't think about this stuff anymore.

I apologize for being curt.

I do recall first ISP's leaving the backend routers with default usernames and passwords way long time ago. Same with first use of DB's and web pages forgetting to remove the default root access passwords also way long time ago.

Such that an update to the documentation would help newbie HS users a bit.

1 - initial HS3 configuration mentions the removal of the default user name and password.
2 - The next line should mention the add of a new user and change of the username and password on HSTouch, HS Speaker, Homeseer 3 and HS Touch designer to a new one configured on the mother ship.

[zguy]

No cuz I change the iNI file for each speaker client before running it and after I have deleted the default user name and password.

That said I would see that error if there is no default user/password defined.

So yeah it doesn't run and yeah the logs state there is no default user/password defined.

It isn't really crippling the software though, just telling you to enable a new username and password.

I am biased a bit though running HS since 1998 which truthfully doesn't help the newbie Homeseer person.

Cuz I really don't think about this stuff anymore.

I apologize for being curt.

I do recall first ISP's leaving the backend routers with default usernames and passwords way long time ago. Same with first use of DB's and web pages forgetting to remove the default root access passwords also way long time ago.

Such that an update to the documentation would help newbie HS users a bit.

1 - initial HS3 configuration mentions the removal of the default user name and password.
2 - The next line should mention the add of a new user and change of the username and password on HSTouch, HS Speaker, Homeseer 3 and HS Touch designer to a new one configured on the mother ship.

Indeed.

Yet the false error message in the log is annoying, and, while not significant, uses some resources and disk space for absolutely nothing.

Might as well get rid of it then...

[Pete]

It does make it easy to run the first time and for demo purposes.

That said leaving HS3 at default mode and once you open up your firewall to using Homeseer 3 to the internet using the default port 80 and default user name and password can and will cause security issues. It has.

Typically here personally flippant a bit on reading instructions and seeing how intuitive an application is.

It is good of you zguy to bring this up for discussion and to fix up the documentation relating to first time use of Homeseer.

I am still PO'd about what sick logic created that Ribbon thing in Microsoft Office calling it a fluent user interface.

Back to the BBQ for me. (WAF thing).

[mikaluch]

Thanks for the clarifications. I hate messy logs because then you don't pay attention to them but that is at least workable.

My favorite user interface was the light pen back when we did CAD with several workstations per PDP-11. We sat next to the PDPs so the entire room was kept cold for the machines. The room was dark so we could see the theoretically colored lines on our "monitors". Every couple hours one of the PDP's would crash losing the work for several people. I sat down there for two years on the B-2 bomber in a winter coat, 10 hours a day in the dark and cold, reaching up 100s of times per hour to punch the screen with that light pen. You would hear the anguished cries around the room as the PDP's crashed. I kid you not, my shoulder still aches to this day. Repetitive motion wrist injuries? Kid stuff.

[Eman]

Ok zguy,

I don't know what Windows you are running but try out a few things:-
Initial - Change the user name and password as stated above by others.
- Change the IP address from localhost (127.0.0.1) to a remote IP on your network (like 192.168.xxx.xxx). I hereby assume that you are not running the speaker on your HomeSeer server. That said some Windows servers (I run Windows Server Essentials 2012 R2) will prevent you from messing about with the localhost IP and port 80 (used by the server). By design Microsoft does not encourage you to log in locally. But if you do then you have to change alot of settings before you do. So as a precaution if you use a speaker lacally then change the IP to a remote one as I have stated above. And in the HomeSeer settings change the port 80 to something else.


On the flip side I noticed you are running very old versions of everything and your CM15A not working. I happen (i think) to have some ACT driver saved up somewhere.


Eman.