search

openbmc / phosphor-user-manager

Apache License 2.0
7 stars 8 forks source link

Separate ManagerConsole and HostConsole access #15

Closed gtmills closed 1 year ago

gtmills commented 1 year ago

Redfish has both ManagerConsole and HostConsole. OpenBMC only has 1 group for these "ssh" In https://gerrit.openbmc.org/c/openbmc/bmcweb/+/50835/ ssh was mapped to both ManagerConsole and HostConsole.

It makes sense these are different "can log into the BMC console" is different than "can log into the host console" and users could have one and not the other.

We should solve this before https://gerrit.openbmc.org/c/openbmc/bmcweb/+/50965 goes in because switching would change behavior in a breaking way.

In IPMI, these are a difference between operator and admin roles.

https://github.com/openbmc/docs/blob/master/architecture/user-management.md#supported-group-roles https://github.com/openbmc/phosphor-user-manager/blob/f1b69fa62c5ceafeec1f084bfbf78402124833bb/user_mgr.hpp#L201

ninadpalsule commented 1 year ago

@gtmills @ratagupt @rthomaiy Any plans to separate ssh into userGroup HostConsole and ManagerConsole? I am interested in getting the acountType PATCH support (https://gerrit.openbmc.org/c/openbmc/bmcweb/+/50965) and this is a requite for PATCH. This is where the accountType split is discussed : https://gerrit.openbmc.org/c/openbmc/bmcweb/+/50835. I think it is easiest to add new group named hostConsole and keep managerConsole mapped to ssh.

joseph-reynolds commented 1 year ago

Another wrinkle is that the SSH interface ssh -p 2200 someuser@${BMCIP} currently checks if the user is in the "priv-admin" group, which implicitly means only users who have the "admin" privilege role (aka the Redfish Administrator role) are allowed to SSH to the BMC. Once we have a proper hostconsole group, this could be changed.

And (if desired) to keep the same behavior when new users are created, the default for the Redfish AccountTypes property would be to add the "ssh" and "hostconsole" groups exactly when role=Administrator. [Edit: shortened hostconsoleaccess to hostconsole.]

ninadpalsule commented 1 year ago

This task is complete with following commits.

gtmills commented 1 year ago

This merged. Thanks @ninadpalsule ! I am going to close this.