summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJohn Estabrook <jestabro@vyos.io>2023-06-24 19:23:56 -0500
committerJohn Estabrook <jestabro@vyos.io>2023-06-24 20:53:17 -0500
commit800c3161bffc40cc46833925ec5aa50f30231476 (patch)
treead2da9753800f590b959229e1ede34432f1070e8
parentb5346bc6cedd54615490fc5ce2e77f6380f46c8c (diff)
downloadvyos-1x-800c3161bffc40cc46833925ec5aa50f30231476.tar.gz
vyos-1x-800c3161bffc40cc46833925ec5aa50f30231476.zip
tacacs: T141: check upper bound on dynamically allocated user accounts
Check upper bound as defined in Debian Policy Manual. Without this check, user 'nobody' will not be available.
-rwxr-xr-xsrc/conf_mode/system-login.py4
1 files changed, 4 insertions, 0 deletions
diff --git a/src/conf_mode/system-login.py b/src/conf_mode/system-login.py
index 5f8dd17cd..24766a5b5 100755
--- a/src/conf_mode/system-login.py
+++ b/src/conf_mode/system-login.py
@@ -49,6 +49,8 @@ nss_config_file = "/etc/nsswitch.conf"
# Minimum UID used when adding system users
MIN_USER_UID: int = 1000
+# Maximim UID used when adding system users
+MAX_USER_UID: int = 59999
# LOGIN_TIMEOUT from /etc/loign.defs minus 10 sec
MAX_RADIUS_TIMEOUT: int = 50
# MAX_RADIUS_TIMEOUT divided by 2 sec (minimum recomended timeout)
@@ -68,6 +70,8 @@ def get_local_users():
for s_user in getpwall():
if getpwnam(s_user.pw_name).pw_uid < MIN_USER_UID:
continue
+ if getpwnam(s_user.pw_name).pw_uid > MAX_USER_UID:
+ continue
if s_user.pw_name in SYSTEM_USER_SKIP_LIST:
continue
local_users.append(s_user.pw_name)