Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[tacacs] Support privilege level 0 #1442

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[tacacs] Support privilege level 0 #1442

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions src/tacacs/nss/0001-Modify-user-map-profile.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,7 +169,7 @@ index 79e62b9..ecfa0b0 100644
+#include <libtac/libtac.h>

-#include "nss_tacplus.h"
+#define MIN_TACACS_USER_PRIV (1)
+#define MIN_TACACS_USER_PRIV (0)
+#define MAX_TACACS_USER_PRIV (15)

static const char *nssname = "nss_tacplus"; /* for syslogs */
Expand Down Expand Up @@ -463,7 +463,7 @@ index 79e62b9..ecfa0b0 100644
+{
+ char *token;
+ char delim[] = ";\n\r";
+ int priv = 0;
+ int priv = -1;
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The default value of “priv_level” in function got_tacacs_user() also need to be changed

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TACACS priv-level 0 is seldom used and defined as non-privilege in general. Any scenarios need to support it?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

does non-privilege mean normal user?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more. 

privilege level 0 = seldom used, but includes 5 commands: disable, enable, exit, help, and logout

it is still valid, we should still enable it.

https://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/13860-PRIV.html

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do we need to modify default value in got_tacacs_user()? I think current behavior is that to treat user as least privileged (0) if search fails?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The original design is that the priv-lvl for the user configuration on the TACACS + server should be set as a valid value(1-15) explicitly. If priv-lvl search fails, it will be set as privileged(0) and not allowed to login in.
If priv-lvl(0) is treated as valid value, the default value should be set as invalid value. Unless we don't care priv-lvl.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think non-privilege means the user has less command privilege. There is no authorization for current SONiC cli, so the original design is to filter non-privilege user to avoid unsafe operation. Maybe it's too hard-coded to limit user's configuration.

+ int gid = 0;
+ char *info = NULL;
+ char *group = NULL;
Expand All @@ -476,7 +476,7 @@ index 79e62b9..ecfa0b0 100644
+ priv = (int)strtoul(token + 10, NULL, 0);
+ if(priv > MAX_TACACS_USER_PRIV || priv < MIN_TACACS_USER_PRIV)
+ {
+ priv = 0;
+ priv = -1;
+ syslog(LOG_WARNING, "%s: user_priv %d out of range",
+ nssname, priv);
}
Expand Down Expand Up @@ -507,7 +507,7 @@ index 79e62b9..ecfa0b0 100644
}
- fclose(conf);

+ if(priv && gid && info && group && shell) {
+ if(priv != -1 && gid && info && group && shell) {
+ useradd_info_t *user = &useradd_grp_list[priv];
+ if(user->info)
+ free(user->info);
Expand Down