diff options
| author | Christian Breunig <christian@breunig.cc> | 2025-05-09 17:50:54 +0200 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2025-05-09 22:31:39 +0200 |
| commit | 9cf35f96450263279aeed1affd37e907d71a3081 (patch) | |
| tree | 5451248cc31136b0869912a21b8ad58772cfe115 /debian | |
| parent | c8e468d4bf720f15e1c0232091399a45e8d9949b (diff) | |
| download | vyos-1x-9cf35f96450263279aeed1affd37e907d71a3081.tar.gz vyos-1x-9cf35f96450263279aeed1affd37e907d71a3081.zip | |
T7443: Un-restricting non-root logins after scheduled reboot/shutdown via pam_nologin
When using reboot in, reboot at, or shutdown in, non-root users are prevented
from logging in via SSH or console starting 5 minutes before the scheduled
shutdown or reboot time.
This behavior is intended by pam_nologin.so, which is included in the SSH and
login PAM stack (default on Debian). While expected, it may be inconvenient
and could be reconsidered.
Diffstat (limited to 'debian')
| -rw-r--r-- | debian/vyos-1x.postinst | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/debian/vyos-1x.postinst b/debian/vyos-1x.postinst index 798ecaa1b..9dd06d5e2 100644 --- a/debian/vyos-1x.postinst +++ b/debian/vyos-1x.postinst @@ -50,6 +50,10 @@ if [[ -e /usr/share/pam-configs/tacplus ]]; then rm /usr/share/pam-configs/tacplus fi +# Disable pam_nologin.so behavior for regular users +sed -i '/^auth[[:space:]]\+requisite[[:space:]]\+pam_nologin\.so$/s/^/#/' /etc/pam.d/login +sed -i '/^account[[:space:]]\+required[[:space:]]\+pam_nologin\.so$/s/^/#/' /etc/pam.d/sshd + # Add TACACS system users required for TACACS based system authentication if ! grep -q '^tacacs' /etc/passwd; then # Add the tacacs group and all 16 possible tacacs privilege-level users to |