From 469267b21944e2469b0faf0bc1b54dad15b1bbcc Mon Sep 17 00:00:00 2001
From: Christian Breunig <christian@breunig.cc>
Date: Mon, 28 Aug 2023 21:24:14 +0200
Subject: Debian: T5521: both RADIUS and TACACS users belong to aaa group, add
group first
---
debian/vyos-1x.postinst | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
(limited to 'debian')
diff --git a/debian/vyos-1x.postinst b/debian/vyos-1x.postinst
index f3dc00b46..b0aefed33 100644
--- a/debian/vyos-1x.postinst
+++ b/debian/vyos-1x.postinst
@@ -29,6 +29,11 @@ do
sed -i "/^# Standard Un\*x authentication\./i${PAM_CONFIG}" $file
done
+# Both RADIUS and TACACS users belong to aaa group - this must be added first
+if ! grep -q '^aaa' /etc/group; then
+ addgroup --firstgid 1000 --quiet aaa
+fi
+
# Remove TACACS user added by base package - we use our own UID range and group
# assignments - see below
if grep -q '^tacacs' /etc/passwd; then
@@ -74,11 +79,6 @@ if ! grep -q '^tacacs' /etc/passwd; then
done 2>&1 | grep -v 'User tacacs${level} already exists'
fi
-
-if ! grep -q '^aaa' /etc/group; then
- addgroup --firstgid 1000 --quiet aaa
-fi
-
# Add RADIUS operator user for RADIUS authenticated users to map to
if ! grep -q '^radius_user' /etc/passwd; then
adduser --quiet --firstuid 1000 --disabled-login --ingroup vyattaop \
--
cgit v1.2.3