summaryrefslogtreecommitdiff
path: root/src/conf_mode/system-login.py
AgeCommit message (Collapse)Author
2023-11-20PAM: T5577: Optimized RADIUS PAM configzsdc
- Added system `radius` group - Added `mandatory` and `optional` modes for RADIUS - Improved PAM config for RADIUS New modes: - `mandatory` - if RADIUS answered with `Access-Reject`, authentication must be stopped and access denied immediately. - `optional` (default) - if RADIUS answers with `Access-Reject`, authentication continues using the next module. In `mandatory` mode authentication will be stopped only if RADIUS clearly answered that access should be denied (no user in RADIUS database, wrong password, etc.). If RADIUS is not available or other errors happen, it will be skipped and authentication will continue with the next module, like in `optional` mode.
2023-07-25login: T4790: Added check of the sum of radius timeoutsaapostoliuk
Added check of the sum of login radius timeouts. It has to be less or eq 50 sec. Added check of a number of login radius servers. It has to be less or eq 8 Otherwise, log in to the device can be discarded. Backported from 1.4
2023-02-04Revert "login: T4975: Fixed broken CLI commands"Christian Breunig
This reverts commit 7b36c363cd5b0168bd83c399f50a0a360ba3ee58. A general solution is implemented in Commit ae9dde04 ("T4975: always sync() filesystem after commit").
2023-02-02login: T4975: Fixed broken CLI commandszsdc
User profile files are not saved to disk after configuration is fully applied. Because of this, after a fast system reset, profile files can be empty, and CLI is broken. This fix adds a `sync()` call after the user's configuration, which should protect from data loss and fix the problem with profiles.
2022-04-04login: T4341: busy wait on userdel(8) until the account was deleted successfullyChristian Poessinger
(cherry picked from commit 796178f69ce09e28ab9f20c7b5e1ce97ef00a1ff)
2022-04-04login: T4341: disable user account prior to deletionChristian Poessinger
(cherry picked from commit efa753bc661d04967237e7ec3d72d3757230aaf9)
2021-09-07login: T971 allow quoting in public-keys optionsPaul Lettington
This patch allows the use of `"` in ssh public-key options which unlocks the ability to set the `from` option in a way that sshd will accept to limit what hosts a user can connect from. (cherry picked from commit 6b52387190f8213e7e02060e894c6ddd4fb7cb3d)
2021-09-02login: T3792: bugfix for usernames containing a hyphenChristian Poessinger
While migrating to get_config_dict() in commit e8a1c291b1 ("login: radius: T3192: migrate to get_config_dict()") the user-name was not excluded from mangling (no_tag_node_value_mangle=True). This resulted in a username "vyos-user" from CLI to be actually created as "vyos_user" on the system. This commit also adds respective Smoketests to prevent this in the future. (cherry picked from commit 658de9ea0fbe91e593f9cf0a8c434791282af100)
2021-07-23login: T3699: verify system username does not conflict with Linux base usersChristian Poessinger
2021-05-27login: T3455: Fix edit level configuration for usersever-sever
2021-01-11login: T3208: fix wrong string formatting on my_setChristian Poessinger
Commit e8a1c291 ("login: radius: T3192: migrate to get_config_dict()") did an invalid forward of the newly encrypted passwort to my_set to store it inside the config. (cherry picked from commit a7fe2ff4fdfcb2619b892aff170d42609965b20b)
2021-01-09login: radius: T3192: remove debug print()Christian Poessinger
(cherry picked from commit 586b440a835cba7d45e50bb6d1781823903332b6)
2021-01-07login: radius: T3192: migrate to get_config_dict()Christian Poessinger
2021-01-07login: radius: T3192: support IPv6 server(s) and source-addressChristian Poessinger
2020-11-27vyos.template: T2720: always enable Jinja2 trim_blocks featureChristian Poessinger
2020-10-09login: T2492: remove empty plaintext-password nodeChristian Poessinger
2020-08-31configd: T2582: add scripts to include list for daemonJohn Estabrook
2020-07-22T2725: Fix config parse for users without passwordsEsa Varemo
Fix for https://phabricator.vyos.net/T2725 T2492 / a07e22377ab83104ac925e13d1824f241f0f8d4a introduced a change which broke the initialization of the user dict. In case the config contained an user without an encrypted-password set, the property would be missing and the commit would crash with `KeyError: 'password_encrypted'`
2020-06-17login: radius: T2299: Implement RADIUS servers priorityDmitriyEshenko
2020-05-29airbag: T2088: explicit enabling of the featureThomas Mangin
airbag must now be explicitly installed. the patch also allow to fully disables the installation of the logging code at setup (and not just installing and doing nothing)
2020-05-22login: T2492: must use try/except when adding user for the first timeChristian Poessinger
2020-05-22login: T2492: re-use code from vyos.utilChristian Poessinger
2020-05-22login: T2492: force setting of encrypted password on first bootChristian Poessinger
2020-05-22login: T2492: fix flake8 warningsChristian Poessinger
2020-05-22login: T2492: do not set encrypted user password when it is not changedChristian Poessinger
2020-04-25login: radius: T2304: add VRF supportChristian Poessinger
This allows the radius client to work when a management VRF is in use.
2020-04-15login: T2295: move from calling an os binary to Python crypt() functionChristian Poessinger
2020-04-12template: T2230: use render to generate templatesThomas Mangin
convert all call to jinja to use template.render
2020-04-11util: T2205: convert system login to call and cmdThomas Mangin
2020-04-09util: T2226: os.system was wrongly converted to runThomas Mangin
os.system does print the ouput of the command, run() does not. A new function called call() does the printing and return the error code.
2020-04-06util: T2226: rewrite certbot to use cmdThomas Mangin
Previously failures of mkpasswd would not be reported to users
2020-04-05system-login: T2230: move inlined templates to dedicated filesChristian Poessinger
2020-03-05login: T2050: extend verify() on public-keysChristian Poessinger
* A type must be present for any one public-key element * A key must be present for any one public-key element
2020-02-27login: T2050: retrieve home directory for SSH keys from OS and not guess itChristian Poessinger
We should not rely on the home dir value stored in user['home_dir'] as if a crazy user will choose username root or any other system user this will fail. Should be deny using root at all?
2020-02-25login: T1948: migrade local and radius configurationsChristian Poessinger
Splitting was not a good idea. By combining both we can create a RADIUS server XML include file which can be reused by multiple implementations to get a uniformed CLI for the users.
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-25 05:22:32 +0000