Describe the bug
root@OpenWrt:/# find / -xdev ( -user 1000 -o -group 1000 ) | wc -l
find /etc /usr /bin /sbin /www /root -xdev ( -user 1000 -o -group 1000 ) | wc -l
4114
3573
ID 1000 is likely the ID of the build process, it does not excist on the router itself:
cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon::1:1:daemon:/var:/bin/false
ftp::55:55:ftp:/home/ftp:/bin/false
network::101:101:network:/var:/bin/false
nobody::65534:65534:nobody:/var:/bin/false
ntp:x:123:123:ntp:/var/run/ntp:/bin/false
dnsmasq:x:453:453:dnsmasq:/var/run/dnsmasq:/bin/false
logd:x:514:514:logd:/var/run/logd:/bin/false
ubus:x:81:81:ubus:/var/run/ubus:/bin/false
This causes issues with for instance dropbear's authorised keys file, which is rather picky on the folder ownership and access.
Also it is a security risk if later a user would be created through a plugin/addon and that user gets assigned UID 1000, this would allow that service very extensive access, with trivial privelage excalation capability.
A poorman's mitigation of this case:
create the user so that it cannot be accedentally be created and assigned to a service
reserved1000:x:1000:1000:reserved uid 1000:/var:/bin/false
But nothing could prevent another user to be assiged to group 1000 which has similar security impacts
OpenWrt version
r32486-30527a4c34
OpenWrt release
25.12.0-rc3
OpenWrt target/subtarget
layerscape/armv8_64b
Device
Mono Gateway Development Kit
Image kind
Official downloaded image
Steps to reproduce
No response
Actual behaviour
root@OpenWrt:/# find / -xdev ( -user 1000 -o -group 1000 ) | wc -l
find /etc /usr /bin /sbin /www /root -xdev ( -user 1000 -o -group 1000 ) | wc -l
4114
3573
and impact on dropbear is visible in logs:
Thu Mar 12 15:29:02 2026 authpriv.info dropbear[12640]: Exit before auth from <192.168.1.138:64784>: (user 'root', 0 fails): Exited normally
Thu Mar 12 15:29:07 2026 authpriv.info dropbear[12660]: Child connection from 192.168.1.138:64787
Thu Mar 12 15:29:07 2026 authpriv.info dropbear[12660]: /etc/dropbear must be owned by user or root, and not writable by group or others
Expected behaviour
No response
Additional info
No response
Diffconfig
Terms
Describe the bug
root@OpenWrt:/# find / -xdev ( -user 1000 -o -group 1000 ) | wc -l
find /etc /usr /bin /sbin /www /root -xdev ( -user 1000 -o -group 1000 ) | wc -l
4114
3573
ID 1000 is likely the ID of the build process, it does not excist on the router itself:
cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon::1:1:daemon:/var:/bin/false
ftp::55:55:ftp:/home/ftp:/bin/false
network::101:101:network:/var:/bin/false
nobody::65534:65534:nobody:/var:/bin/false
ntp:x:123:123:ntp:/var/run/ntp:/bin/false
dnsmasq:x:453:453:dnsmasq:/var/run/dnsmasq:/bin/false
logd:x:514:514:logd:/var/run/logd:/bin/false
ubus:x:81:81:ubus:/var/run/ubus:/bin/false
This causes issues with for instance dropbear's authorised keys file, which is rather picky on the folder ownership and access.
Also it is a security risk if later a user would be created through a plugin/addon and that user gets assigned UID 1000, this would allow that service very extensive access, with trivial privelage excalation capability.
A poorman's mitigation of this case:
create the user so that it cannot be accedentally be created and assigned to a service
reserved1000:x:1000:1000:reserved uid 1000:/var:/bin/false
But nothing could prevent another user to be assiged to group 1000 which has similar security impacts
OpenWrt version
r32486-30527a4c34
OpenWrt release
25.12.0-rc3
OpenWrt target/subtarget
layerscape/armv8_64b
Device
Mono Gateway Development Kit
Image kind
Official downloaded image
Steps to reproduce
No response
Actual behaviour
root@OpenWrt:/# find / -xdev ( -user 1000 -o -group 1000 ) | wc -l
find /etc /usr /bin /sbin /www /root -xdev ( -user 1000 -o -group 1000 ) | wc -l
4114
3573
and impact on dropbear is visible in logs:
Thu Mar 12 15:29:02 2026 authpriv.info dropbear[12640]: Exit before auth from <192.168.1.138:64784>: (user 'root', 0 fails): Exited normally
Thu Mar 12 15:29:07 2026 authpriv.info dropbear[12660]: Child connection from 192.168.1.138:64787
Thu Mar 12 15:29:07 2026 authpriv.info dropbear[12660]: /etc/dropbear must be owned by user or root, and not writable by group or others
Expected behaviour
No response
Additional info
No response
Diffconfig
Terms