diff options
| author | Christian Poessinger <christian@poessinger.com> | 2022-10-18 11:30:05 +0200 |
|---|---|---|
| committer | Christian Poessinger <christian@poessinger.com> | 2022-10-18 11:32:15 +0200 |
| commit | 1ccc608264ad7daa05508330876707e22972e1ea (patch) | |
| tree | b2db7165b4bcda7da94babc1cc6064e96c6607cb | |
| parent | e04aa5f1a8c2d53bfa89949cc57cb057be633bd1 (diff) | |
| download | vyatta-cfg-system-1ccc608264ad7daa05508330876707e22972e1ea.tar.gz vyatta-cfg-system-1ccc608264ad7daa05508330876707e22972e1ea.zip | |
T4533: Allow basic permissions to unprivileged RADIUS users
Backport of https://github.com/vyos/vyos-1x/pull/1598 for VyOS 1.3
Allows RADIUS authenticated users to perform ping/traceroute action(s).
| -rw-r--r-- | sysconf/sudoers | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/sysconf/sudoers b/sysconf/sudoers index 998e7083..309f1467 100644 --- a/sysconf/sudoers +++ b/sysconf/sudoers @@ -26,7 +26,7 @@ Cmnd_Alias IPFLUSH = /sbin/ip route flush cache, \ /sbin/ip -f inet6 route flush cache, \ /sbin/ip -f inet6 route flush cache *,\ /sbin/ip -f inet6 neigh flush to *, \ - /sbin/ip -f inet6 neigh flush dev * + /sbin/ip -f inet6 neigh flush dev * Cmnd_Alias ETHTOOL = /sbin/ethtool -p *, \ /sbin/ethtool -S *, \ /sbin/ethtool -a *, \ @@ -40,10 +40,13 @@ Cmnd_Alias PCAPTURE = /usr/bin/tcpdump Cmnd_Alias HWINFO = /usr/bin/lspci Cmnd_Alias FORCE_CLUSTER = /usr/share/heartbeat/hb_takeover, \ /usr/share/heartbeat/hb_standby +Cmnd_Alias DIAGNOSTICS = /bin/ip vrf exec * /bin/ping *, \ + /bin/ip vrf exec * /bin/traceroute *, \ + /usr/libexec/vyos/op_mode/* %operator ALL=NOPASSWD: DATE, IPTABLES, ETHTOOL, IPFLUSH, HWINFO, \ PPPOE_CMDS, PCAPTURE, /usr/sbin/wanpipemon, \ DMIDECODE, DISK, CONNTRACK, IP6TABLES, \ - FORCE_CLUSTER + FORCE_CLUSTER, DIAGNOSTICS # Allow any user to run files in sudo-users %users ALL=NOPASSWD: /opt/vyatta/bin/sudo-users/ |