Skip to main content

Login

The interface and the whole API are only available after logging in. Only administrators can log in: Linux users who are members of the group bunkerbox-admin. Users with the role "user" never get into the interface; they only access the shares they were granted.

Password​

The administrator's Linux password applies. Bunkerbox verifies it against /etc/shadow (locked and expired accounts are refused). A wrong password and an account without administrator rights give the same message, so user names cannot be probed.

Session​

  • After login a session is valid that ends after 30 minutes of inactivity and after 12 hours at the latest. Both values can be changed under Settings → Sessions.
  • Log out in the user menu at the top right ends the session immediately.
  • Changing an administrator's password, revoking the role or disabling the account ends all of that user's sessions.
  • Running sessions check about once a minute whether the account is still in the group bunkerbox-admin and neither locked nor expired. Sessions therefore also end when an account was changed outside the interface (e.g. usermod -L or gpasswd -d).

Protection against attacks​

  • After 5 failed attempts from one address within 15 minutes, logging in from that address is blocked for 15 minutes. Every attempt counts immediately, even when many arrive at the same time.
  • A user name is never locked, so nobody can lock administrators out on purpose. From 10 failed attempts (from any address) within 15 minutes, every further attempt for that name is delayed, starting at 1 second and doubling up to at most 30 seconds.
  • At most 4 password checks run at the same time; more are refused with "too many logins".
  • Unknown, locked or expired accounts still get a password check of the same cost, so the response time does not reveal which user names exist.
  • The address used for blocking is the actual peer of the connection. X-Forwarded-For and X-Forwarded-Proto are only taken from a reverse proxy listed in BUNKERBOX_TRUSTED_PROXIES (see Installation).
  • Login requests may be at most 8 KiB, all other JSON requests at most 1 MiB.
  • Changing requests are only accepted when they come from the interface itself (check of Origin or Sec-Fetch-Site).
  • The session cookie is HttpOnly and SameSite=Strict, behind HTTPS also Secure.

Mock mode​

In mock mode (development, BUNKERBOX_MOCK=1) the login is admin / admin.