[GH-ISSUE #563] Deleted admin account gets recreated with default password #204

New issue

Closed

opened 2026-02-27 08:15:51 +03:00 by kerem · 1 comment

kerem commented

2026-02-27 08:15:51 +03:00

Owner

Originally created by @hpaantee on GitHub (Apr 24, 2023).
Original GitHub issue: https://github.com/lldap/lldap/issues/563

First of all, thanks for developing this great software. It's easy to use and deploy.
However, I just noticed that when you delete the default admin "admin", it gets recreated with the default password and privileges.
That means, to e.g. protect against brute force attacks, deleting it and using another admin account (with different name) instead, this recreates the default one.
This seems dangerous, as people might not suspect that behavior and allows access to ldap via the typical admin/password combo.

Currently I changed it's password and removed it from the administrator group. But lldap should just check if there is at least one other user member of the administrator group.

Originally created by @hpaantee on GitHub (Apr 24, 2023). Original GitHub issue: https://github.com/lldap/lldap/issues/563 First of all, thanks for developing this great software. It's easy to use and deploy. However, I just noticed that when you delete the default admin "admin", it gets recreated with the default password and privileges. That means, to e.g. protect against brute force attacks, deleting it and using another admin account (with different name) instead, this recreates the default one. This seems dangerous, as people might not suspect that behavior and allows access to ldap via the typical admin/password combo. Currently I changed it's password and removed it from the administrator group. But lldap should just check if there is at least one other user member of the administrator group.

kerem

2026-02-27 08:15:51 +03:00

closed this issue
added the
bug

good first issue

backend
labels

kerem commented

2026-02-27 08:15:52 +03:00

Author

Owner

@nitnelave commented on GitHub (Apr 24, 2023):

I think we can simply check whether there are any users, it shouldn't be possible as an admin to remove yourself from the admin group, so there will always be one.

@nitnelave commented on GitHub (Apr 24, 2023): I think we can simply check whether there are any users, it shouldn't be possible as an admin to remove yourself from the admin group, so there will always be one.

kerem referenced this issue

2026-02-27 08:18:11 +03:00

[PR #204] [MERGED] hotfix, use Dockerfile.ci #612