<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi Joseph, <br>
</p>
For SSH to work fine, user must be part of priv-admin and must have
command/shell as /bin/sh under /etc/passwd file instead of
/bin/nologin. Note: There is no direct group called ssh under
/etc/group, instead it is just emulated one from
phosphor-user-manager to add corresponding shell binary to the user.<br>
usermod --shell /bin/sh -G priv-admin ${USER}<br>
<br>
If requirement is SSH to be allowed based on group and allowed for
all user privileges, then user shell can be updated using usermod
--shell /bin/sh itself, but need to remove EXTRA_ARGS from the <a
moz-do-not-send="true"
href="https://github.com/openbmc/openbmc/blob/master/meta-phosphor/recipes-core/dropbear/dropbear/dropbear.default">dropbear.default</a><br>
<p>Regards,</p>
<p>Richard<br>
</p>
<div class="moz-cite-prefix">On 11/17/2020 3:49 AM, Joseph Reynolds
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:8031d32c-9dd2-a72a-7751-8784fe9d2d99@linux.ibm.com">
<br>
What is the right way to assign default phosphor-user-manager
"group roles" to dynamically created users?
<br>
<br>
Background: Currently, when a new local user is created via
Redfish API POST /redfish/v1/AccountService/Accounts you have to
specify a Redfish RoleId. BMCWeb maps the RoleId to a phosphor
user manager "Privilege Role" [1] and assigns ALL of the "group
roles" to the new user [2]. Per [3] this is not intended, and I
need to fix this for my use case.
<br>
<br>
</blockquote>
usermod --shell /bin/sh -G priv-admin ${USER} is the correct command
for per[3].<br>
<blockquote type="cite"
cite="mid:8031d32c-9dd2-a72a-7751-8784fe9d2d99@linux.ibm.com">IMHO,
the correct approach is for the project to define a mapping from
"role" to "privilege role" that can be used when dynamically
creating a new user. For example, the admin role maps to "ssh
ipmi redfish web" whereas the readonly role maps to "ipmi redfish
web" (omits "ssh"). Then images can customize this as needed.
<br>
<br>
But where should this mapping be applied? Does it belong in
BMCWeb or in phosphor-user-manager [4]? Should we have another
D-Bus property [5] to give this mapping?
<br>
</blockquote>
As of today, we are not separating user groups. All users created in
OpenBMC belongs to the build time configured groups.<br>
<blockquote type="cite"
cite="mid:8031d32c-9dd2-a72a-7751-8784fe9d2d99@linux.ibm.com">
<br>
- Joseph
<br>
<br>
[1]:
<a class="moz-txt-link-freetext" href="https://github.com/openbmc/docs/blob/master/architecture/user-management.md">https://github.com/openbmc/docs/blob/master/architecture/user-management.md</a><br>
[2]:
<a class="moz-txt-link-freetext" href="https://github.com/openbmc/bmcweb/blob/929d4b57f10bc4200e16b71fbcf32521d8cc23c1/redfish-core/lib/account_service.hpp#L1435">https://github.com/openbmc/bmcweb/blob/929d4b57f10bc4200e16b71fbcf32521d8cc23c1/redfish-core/lib/account_service.hpp#L1435</a><br>
[3]: <a class="moz-txt-link-freetext" href="https://github.com/openbmc/openbmc/issues/3643">https://github.com/openbmc/openbmc/issues/3643</a>
<br>
[4]:
<a class="moz-txt-link-freetext" href="https://github.com/openbmc/phosphor-user-manager/blob/master/user_mgr.hpp">https://github.com/openbmc/phosphor-user-manager/blob/master/user_mgr.hpp</a><br>
[5]:
<a class="moz-txt-link-freetext" href="https://github.com/openbmc/phosphor-dbus-interfaces/blob/master/xyz/openbmc_project/User/Manager.interface.yaml">https://github.com/openbmc/phosphor-dbus-interfaces/blob/master/xyz/openbmc_project/User/Manager.interface.yaml</a><br>
<br>
</blockquote>
</body>
</html>