summaryrefslogtreecommitdiff
path: root/src/conf_mode/system-login.py
diff options
context:
space:
mode:
authorViacheslav Hletenko <v.gletenko@vyos.io>2023-02-27 09:55:44 +0200
committerGitHub <noreply@github.com>2023-02-27 09:55:44 +0200
commit1cc8d7c89459ecfe315cab47458af5cc00d975ca (patch)
treee5fa08a5534d0c4673685519da8edaa6623b20a5 /src/conf_mode/system-login.py
parent6d29c4c76b5affa64ae1b2e697984cafe5664246 (diff)
parent1bde9ebee6812a1497f8b6d36e684235e41631f2 (diff)
downloadvyos-1x-1cc8d7c89459ecfe315cab47458af5cc00d975ca.tar.gz
vyos-1x-1cc8d7c89459ecfe315cab47458af5cc00d975ca.zip
Merge pull request #1644 from aapostoliuk/T4790-sagitta
T4790: Added check of the sum of radius timeouts
Diffstat (limited to 'src/conf_mode/system-login.py')
-rwxr-xr-xsrc/conf_mode/system-login.py22
1 files changed, 18 insertions, 4 deletions
diff --git a/src/conf_mode/system-login.py b/src/conf_mode/system-login.py
index 74e8827ef..0a4a88bf8 100755
--- a/src/conf_mode/system-login.py
+++ b/src/conf_mode/system-login.py
@@ -42,6 +42,11 @@ airbag.enable()
autologout_file = "/etc/profile.d/autologout.sh"
radius_config_file = "/etc/pam_radius_auth.conf"
+# LOGIN_TIMEOUT from /etc/loign.defs minus 10 sec
+MAX_RADIUS_TIMEOUT: int = 50
+# MAX_RADIUS_TIMEOUT divided by 2 sec (minimum recomended timeout)
+MAX_RADIUS_COUNT: int = 25
+
def get_local_users():
"""Return list of dynamically allocated users (see Debian Policy Manual)"""
local_users = []
@@ -124,18 +129,27 @@ def verify(login):
if 'radius' in login:
if 'server' not in login['radius']:
raise ConfigError('No RADIUS server defined!')
-
+ sum_timeout: int = 0
+ radius_servers_count: int = 0
fail = True
for server, server_config in dict_search('radius.server', login).items():
if 'key' not in server_config:
raise ConfigError(f'RADIUS server "{server}" requires key!')
-
- if 'disabled' not in server_config:
+ if 'disable' not in server_config:
+ sum_timeout += int(server_config['timeout'])
+ radius_servers_count += 1
fail = False
- continue
+
if fail:
raise ConfigError('All RADIUS servers are disabled')
+ if radius_servers_count > MAX_RADIUS_COUNT:
+ raise ConfigError('Number of RADIUS servers more than 25 ')
+
+ if sum_timeout > MAX_RADIUS_TIMEOUT:
+ raise ConfigError('Sum of RADIUS servers timeouts '
+ 'has to be less or eq 50 sec')
+
verify_vrf(login['radius'])
if 'source_address' in login['radius']: