Skip to content

Login through RADIUS is not working due to invalid shell #13141

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
saravanan-i wants to merge 2 commits into
base: master
Choose a base branch
from
+2 −2
Open

Login through RADIUS is not working due to invalid shell #13141

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1010897
Issue Description: Login through RADIUS is not working
saravanan-i Dec 22, 2022
84f2fa6
Removed unrelated changes
saravanan-i Dec 23, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions src/radius/nss/libnss-radius/nss_radius_common.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,11 +159,11 @@ static void init_rnm(RADIUS_NSS_CONF_B * conf) {
rnm[0].gid = 999;
rnm[0].groups = "docker";
Copy link

@Yarden-Z Yarden-Z Jun 27, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To reduce the attack surface, maybe change the default group given here.
MPL = 0 user does not require docker, but maybe it does require the redis group or adm group.

Copy link
Author

@saravanan-i saravanan-i Jul 18, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @Yarden-Z . They were defined as per the existing RADIUS design document of SoNIC ( RADIUS_Design ). I haven't introduced them as part of this pull request. Can you please confirm if you have to change the same ?

Copy link

@Yarden-Z Yarden-Z Jul 27, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I understand that these values were introduced in the HLD design.
But given this item - I think we can re-visit this.
From my perspective, a non-privileged user requires redis (potentially) and the default adm group.
If I understood your question

Copy link
Collaborator

@qiluo-msft qiluo-msft Jun 27, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The readonly user should be in users group, and no docker group membership. #WontFix

Copy link
Author

@saravanan-i saravanan-i Jul 18, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @qiluo-msft. User groups were defined based on existing RADIUS design document of SoNiC RADIUS_Design. I haven't introduced them as part of this pull request. Can you please confirm if we have to modify the same ?

Copy link
Contributor

@dt-nexthop dt-nexthop May 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@saravanan-i I think we should remove this docker group because the sudoer file already allows for the read-only docker commands. Adding docker group allows this user to potentially do non-read_only things. I can push that change if you want to give me access to this branch so we can keep all the history of this PR without having to make a new one.

rnm[0].gecos = "remote_user";
rnm[0].shell = "/usr/bin/sonic-launch-shell";
rnm[0].shell = "/bin/bash";
rnm[RADIUS_MAX_MPL-1].gid = 1000;
rnm[RADIUS_MAX_MPL-1].groups = "admin,sudo,docker";
rnm[RADIUS_MAX_MPL-1].gecos = "remote_user_su";
rnm[RADIUS_MAX_MPL-1].shell = "/usr/bin/sonic-launch-shell";
rnm[RADIUS_MAX_MPL-1].shell = "/bin/bash";

}

Expand Down