From 6a7558e586cfa91823512681e12944b065754774 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Sat, 26 Sep 2026 08:29:22 +0200 Subject: accel-ppp: T9357: do not require local users when any-login is configured Committing "service pppoe-server authentication any-login" failed with "Authentication mode local requires local users to be configured!" even though any-login accepts any username/password combination, making local user accounts pointless. verify_accel_ppp_authentication() raised unconditionally whenever authentication mode was "local" - the default - without ever consulting the any-login option. Skip that requirement when any-login is set, while keeping the password and rate-limit validation for users that are configured. --- python/vyos/accel_ppp_util.py | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) (limited to 'python') diff --git a/python/vyos/accel_ppp_util.py b/python/vyos/accel_ppp_util.py index 844bc56e5..c70f3b017 100644 --- a/python/vyos/accel_ppp_util.py +++ b/python/vyos/accel_ppp_util.py @@ -130,19 +130,23 @@ def verify_accel_ppp_authentication(config, local_users=True): Common helper function which must be used by all Accel-PPP services based on get_config_dict() """ + # "any-login" accepts every username/password combination, thus there is + # no need to have any local user account configured at all + any_login = False + if 'authentication' in config and 'any_login' in config['authentication']: + any_login = True + # verify auth settings if local_users and dict_search("authentication.mode", config) == "local": - if ( - dict_search("authentication.local_users", config) is None - or dict_search("authentication.local_users", config) == {} - ): + local_users_config = dict_search('authentication.local_users.username', + config, default={}) + + if not local_users_config and not any_login: raise ConfigError( "Authentication mode local requires local users to be configured!" ) - for user in dict_search("authentication.local_users.username", config): - user_config = config["authentication"]["local_users"]["username"][user] - + for user, user_config in local_users_config.items(): if "password" not in user_config: raise ConfigError(f'Password required for local user "{user}"') -- cgit v1.2.3