[tacacs] Support privilege level 0 #1442
Conversation
|
@liuqu, could you kindly help review? |
| @@ -463,7 +463,7 @@ index 79e62b9..ecfa0b0 100644 | |||
| +{ | |||
| + char *token; | |||
| + char delim[] = ";\n\r"; | |||
| + int priv = 0; | |||
| + int priv = -1; | |||
There was a problem hiding this comment.
The default value of “priv_level” in function got_tacacs_user() also need to be changed
There was a problem hiding this comment.
TACACS priv-level 0 is seldom used and defined as non-privilege in general. Any scenarios need to support it?
There was a problem hiding this comment.
does non-privilege mean normal user?
There was a problem hiding this comment.
privilege level 0 = seldom used, but includes 5 commands: disable, enable, exit, help, and logout
it is still valid, we should still enable it.
There was a problem hiding this comment.
Why do we need to modify default value in got_tacacs_user()? I think current behavior is that to treat user as least privileged (0) if search fails?
There was a problem hiding this comment.
The original design is that the priv-lvl for the user configuration on the TACACS + server should be set as a valid value(1-15) explicitly. If priv-lvl search fails, it will be set as privileged(0) and not allowed to login in.
If priv-lvl(0) is treated as valid value, the default value should be set as invalid value. Unless we don't care priv-lvl.
There was a problem hiding this comment.
I think non-privilege means the user has less command privilege. There is no authorization for current SONiC cli, so the original design is to filter non-privilege user to avoid unsafe operation. Maybe it's too hard-coded to limit user's configuration.
|
@taoyl-ms , do we still need this? |
Avoid adding loopback interface (ip link add) when setting nat zone on loopback interface (#1434) [acl] Remove Ethertype from L3V6 qualifiers (#1433) Sflow fixes during DEL processing (#1427) Fix #3971 by skipping create-only SAI attributes when modifying buffer pools or profiles in orchagent (#1430) Fix issue: bufferorch only pass the first attribute to sai when setting attribute (#1442) Signed-off-by: Abhishek Dosi <abdosi@microsoft.com>
be51ebc Add IPv6 key item support to request parser (sonic-net#1449) 76e2251 When teamd feature state is disabled the Netdevice created by teamd were (sonic-net#1450) 6aa97ce Use .clear() after std::move() (sonic-net#1444) d5757db Add libzmq to README dependencies (sonic-net#1447) c7b262e Add libzmq to Makefiles (sonic-net#1443) 0b2e59a [drop counters] Clarify log messages for initial counter setup (sonic-net#1445) 003cf24 [dvs] Refactor and add buffer pool wm test (sonic-net#1446) 2f5d2d9 [acl] Remove Ethertype from L3V6 qualifiers (sonic-net#1433) f7b974f Fix issue: bufferorch only pass the first attribute to sai when setting attribute (sonic-net#1442) Signed-off-by: Abhishek Dosi <abdosi@microsoft.com>
be51ebc Add IPv6 key item support to request parser (#1449) 76e2251 When teamd feature state is disabled the Netdevice created by teamd were (#1450) 6aa97ce Use .clear() after std::move() (#1444) d5757db Add libzmq to README dependencies (#1447) c7b262e Add libzmq to Makefiles (#1443) 0b2e59a [drop counters] Clarify log messages for initial counter setup (#1445) 003cf24 [dvs] Refactor and add buffer pool wm test (#1446) 2f5d2d9 [acl] Remove Ethertype from L3V6 qualifiers (#1433) f7b974f Fix issue: bufferorch only pass the first attribute to sai when setting attribute (#1442) Signed-off-by: Abhishek Dosi <abdosi@microsoft.com>
…ng attribute (sonic-net#1442) Signed-off-by: Stephen Sun <stephens@nvidia.com>
be51ebc Add IPv6 key item support to request parser (sonic-net#1449) 76e2251 When teamd feature state is disabled the Netdevice created by teamd were (sonic-net#1450) 6aa97ce Use .clear() after std::move() (sonic-net#1444) d5757db Add libzmq to README dependencies (sonic-net#1447) c7b262e Add libzmq to Makefiles (sonic-net#1443) 0b2e59a [drop counters] Clarify log messages for initial counter setup (sonic-net#1445) 003cf24 [dvs] Refactor and add buffer pool wm test (sonic-net#1446) 2f5d2d9 [acl] Remove Ethertype from L3V6 qualifiers (sonic-net#1433) f7b974f Fix issue: bufferorch only pass the first attribute to sai when setting attribute (sonic-net#1442) Signed-off-by: Abhishek Dosi <abdosi@microsoft.com>
…ng attribute (sonic-net#1442) Signed-off-by: Stephen Sun <stephens@nvidia.com>
- What I did
To support tacacs user privilege level 0 by setting
MIN_TACACS_USER_PRIV = 0in tacacs-nss patch.