4 ms·

Same, my setup is 100% Unifi from back before they started going downhill. At least I was self-hosting the software so I wasn't bitten by this breach.

izacus 6y ago
Hmm, even the self-hosted SW can use SSO from cloud... so I'm now worried that our equipment is still vulnerable by whatever system allows cloud logins.
pseudalopex 6y ago
They forced cloud authentication on self hosted software too.[1] [1] https://www.reddit.com/r/Ubiquiti/comments/kslyh9/cloud_key_local_account/ https://www.reddit.com/r/Ubiquiti/comments/kslyh9/cloud_key_...
- imiric 6y ago
  Wow, that's awful. I have a few Ubiquiti devices I haven't updated in months, that don't use any cloud accounts, and I used to run their controller software in a container that I only started when I needed to administer something. But now I guess I'm never updating and will be looking to get rid of all their equipment. What an incredibly consumer hostile and incompetent company. Shame, because the hardware pretty much works reliably.
  - Ueland 6y ago
    Im a bit confused by this. I run a UniFi Controller in a docker container, have a few APs and a router, and everything works fine. No cloud stuff going on here. Am i just lucky or something that i havent been forced to the cloud yet, or is it something i am missing here?
    - jmuguy 6y ago
      I think its just the cloud key. I have a unifi controller install as well and use a local account with no issues.
      - stock_toaster 6y ago
        I have a cloud key with no cloud access. It's just that cloud access is the user directed workflow for sure. Setup without cloud access was not clear at all [1]. [1]: I don't even remember the steps, to be honest!
- deleted 6y ago
  [deleted]
surfsvammel 6y ago
Apparently I was... Now, updated the firmware and it says server certificate changed. Frikkin A. Now I am in 'what the hell' land
- easton 6y ago
  It probably just regenerated after the firmware updated, to be honest. I think it does it after a factory reset, and it's signed by the local device.
xoa 6y ago
We should be clear here that there are multiple types of "self-hosted". Ubiquiti makes essentially little (weaker) Raspberry Pi devices with PoE that are dedicated to just the controller, and a few years back they also forced their (garbage) "Protect" onto their hardware only. They (confusingly) call these "Cloud Keys", though they have nothing to do with the cloud. However, you can also get 100% standalone versions of the Controller that will run on any server or VM you've got, Linux, Windows, or Mac. This is just the Java 8-based controller software and that's it, and you can lock those down arbitrarily hard for any WAN access same as any other LAN network software, no general internet access is needed at all and no firmware is involved. A lot of people quite reasonably got CKs seeing them as very easy ways to have a low power always on local controller since they didn't have some other server running 24/7 already. If the firmware on those was updated to require tie-in to Ubiquiti's SSO that's a horrible betrayal. But I'm confident in saying the full standalone Controller doesn't since I have mine locked down from any general net access, remote L3 management was done to IP only at the firewall and I've been switching to just putting it all through WireGuard.

izacus 6y ago

Hmm, even the self-hosted SW can use SSO from cloud... so I'm now worried that our equipment is still vulnerable by whatever system allows cloud logins.

pseudalopex 6y ago

They forced cloud authentication on self hosted software too.[1] [1] https://www.reddit.com/r/Ubiquiti/comments/kslyh9/cloud_key_local_account/ https://www.reddit.com/r/Ubiquiti/comments/kslyh9/cloud_key_...

imiric 6y ago
Wow, that's awful. I have a few Ubiquiti devices I haven't updated in months, that don't use any cloud accounts, and I used to run their controller software in a container that I only started when I needed to administer something. But now I guess I'm never updating and will be looking to get rid of all their equipment. What an incredibly consumer hostile and incompetent company. Shame, because the hardware pretty much works reliably.
- Ueland 6y ago
  Im a bit confused by this. I run a UniFi Controller in a docker container, have a few APs and a router, and everything works fine. No cloud stuff going on here. Am i just lucky or something that i havent been forced to the cloud yet, or is it something i am missing here?
  - jmuguy 6y ago
    I think its just the cloud key. I have a unifi controller install as well and use a local account with no issues.
    - stock_toaster 6y ago
      I have a cloud key with no cloud access. It's just that cloud access is the user directed workflow for sure. Setup without cloud access was not clear at all [1]. [1]: I don't even remember the steps, to be honest!
deleted 6y ago
[deleted]

surfsvammel 6y ago

Apparently I was... Now, updated the firmware and it says server certificate changed. Frikkin A. Now I am in 'what the hell' land

easton 6y ago
It probably just regenerated after the firmware updated, to be honest. I think it does it after a factory reset, and it's signed by the local device.

xoa 6y ago

We should be clear here that there are multiple types of "self-hosted". Ubiquiti makes essentially little (weaker) Raspberry Pi devices with PoE that are dedicated to just the controller, and a few years back they also forced their (garbage) "Protect" onto their hardware only. They (confusingly) call these "Cloud Keys", though they have nothing to do with the cloud. However, you can also get 100% standalone versions of the Controller that will run on any server or VM you've got, Linux, Windows, or Mac. This is just the Java 8-based controller software and that's it, and you can lock those down arbitrarily hard for any WAN access same as any other LAN network software, no general internet access is needed at all and no firmware is involved. A lot of people quite reasonably got CKs seeing them as very easy ways to have a low power always on local controller since they didn't have some other server running 24/7 already. If the firmware on those was updated to require tie-in to Ubiquiti's SSO that's a horrible betrayal. But I'm confident in saying the full standalone Controller doesn't since I have mine locked down from any general net access, remote L3 management was done to IP only at the firewall and I've been switching to just putting it all through WireGuard.