cli: new admin-exec level command 'show nacm'

Show operational details about nacm and user//group mappings.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

src/statd/python/cli_pretty/cli_pretty.py

@@ -2906,6 +2906,73 @@ def show_ntp_source(json, address=None):
         print(row)
 
 
+def show_nacm(json):
+    """Display users and NACM (Network Configuration Access Control) groups"""
+    min_width = 62
+
+    nacm = json.get("ietf-netconf-acm:nacm", {})
+    if not nacm:
+        print("NACM not configured.")
+        print()
+
+    if nacm:
+        enabled = "yes" if nacm.get("enable-nacm", True) else "no"
+        print(f"{'enabled':<25}: {enabled}")
+        print(f"{'default read access':<25}: {nacm.get('read-default', 'permit')}")
+        print(f"{'default write access':<25}: {nacm.get('write-default', 'deny')}")
+        print(f"{'default exec access':<25}: {nacm.get('exec-default', 'permit')}")
+        print(f"{'denied operations':<25}: {nacm.get('denied-operations', 0)}")
+        print(f"{'denied data writes':<25}: {nacm.get('denied-data-writes', 0)}")
+        print(f"{'denied notifications':<25}: {nacm.get('denied-notifications', 0)}")
+        print()
+
+    # Users table
+    system = json.get("ietf-system:system", {})
+    users = system.get("authentication", {}).get("user", [])
+    if users:
+        user_table = SimpleTable([
+            Column('USER', min_width=12),
+            Column('SHELL'),
+            Column('LOGIN', flexible=True)
+        ], min_width=min_width)
+
+        for user in users:
+            name = user.get("name", "")
+            shell_data = user.get("infix-system:shell", "false")
+            shell = shell_data.split(":")[-1] if ":" in shell_data else shell_data
+
+            has_password = bool(user.get("password"))
+            has_keys = bool(user.get("authorized-key"))
+            if has_password and has_keys:
+                login = "password+key"
+            elif has_password:
+                login = "password"
+            elif has_keys:
+                login = "key"
+            else:
+                login = "-"
+
+            user_table.row(name, shell, login)
+
+        user_table.print()
+        print()
+
+    # Groups table
+    groups = nacm.get("groups", {}).get("group", []) if nacm else []
+    if groups:
+        group_table = SimpleTable([
+            Column('GROUP', min_width=12),
+            Column('USERS', flexible=True)
+        ], min_width=min_width)
+
+        for group in groups:
+            name = group.get("name", "")
+            members = " ".join(group.get("user-name", []))
+            group_table.row(name, members)
+
+        group_table.print()
+
+
 def show_system(json):
     """System information overivew"""
     if not json.get("ietf-system:system-state"):
@@ -4890,6 +4957,8 @@ def main():
     subparsers.add_parser('show-firewall-log', help='Show firewall log') \
               .add_argument('limit', nargs='?', help='Last N lines, default: all')
 
+    subparsers.add_parser('show-nacm', help='Show NACM status and groups')
+
     subparsers.add_parser('show-ntp', help='Show NTP status') \
               .add_argument('-a', '--address', help='Show details for specific address')
     subparsers.add_parser('show-ntp-tracking', help='Show NTP tracking status')
@@ -4953,6 +5022,8 @@ def main():
         show_firewall_service(json_data, args.name)
     elif args.command == "show-firewall-log":
         show_firewall_logs(args.limit)
+    elif args.command == "show-nacm":
+        show_nacm(json_data)
     elif args.command == "show-ntp":
         show_ntp(json_data, args.address)
     elif args.command == "show-ntp-tracking":

src/statd/python/yanger/ietf_system.py

@@ -262,28 +262,75 @@ def add_timezone(out):
 
 
 def add_users(out):
-    shadow_output = HOST.run_multiline(["getent", "shadow"], [])
-    users = []
+    # Map shell paths to YANG identity names
+    shell_map = {
+        "/bin/bash": "infix-system:bash",
+        "/bin/sh": "infix-system:sh",
+        "/usr/bin/clish": "infix-system:clish",
+        "/bin/false": "infix-system:false",
+        "/sbin/nologin": "infix-system:false",
+        "/usr/sbin/nologin": "infix-system:false",
+    }
 
+    # Get users from /etc/passwd - include users with 1000 <= uid < 10000 (added by confd)
+    passwd_output = HOST.run_multiline(["getent", "passwd"], [])
+    passwd_users = {}
+    for line in passwd_output:
+        parts = line.split(':')
+        if len(parts) >= 7:
+            username = parts[0]
+            uid = int(parts[2]) if parts[2].isdigit() else 0
+            shell = parts[6].strip()
+            if 1000 <= uid < 10000:
+                passwd_users[username] = shell_map.get(shell, "infix-system:false")
+
+    # Get password hashes from shadow
+    shadow_output = HOST.run_multiline(["getent", "shadow"], [])
+    shadow_hashes = {}
     for line in shadow_output:
         parts = line.split(':')
-        if len(parts) < 2:
-            continue
-        username = parts[0]
-        password_hash = parts[1]
+        if len(parts) >= 2:
+            username = parts[0]
+            password_hash = parts[1]
+            # Only include valid password hashes (not locked/disabled)
+            if (password_hash and
+                not password_hash.startswith('*') and
+                not password_hash.startswith('!')):
+                shadow_hashes[username] = password_hash
+
+    # Build user list from passwd users (1000 <= uid < 10000)
+    users = []
+    for username, shell in passwd_users.items():
+        user = {"name": username}
+        if username in shadow_hashes:
+            user["password"] = shadow_hashes[username]
+        user["infix-system:shell"] = shell
+
+        # Read SSH authorized keys from /var/run/sshd/${user}.keys
+        keys_file = f"/var/run/sshd/{username}.keys"
+        keys_content = HOST.read(keys_file)
+        if keys_content:
+            authorized_keys = []
+            for line in keys_content.splitlines():
+                line = line.strip()
+                if not line or line.startswith('#'):
+                    continue
+                parts = line.split(None, 2)
+                if len(parts) >= 2:
+                    algorithm = parts[0]
+                    key_data = parts[1]
+                    # Use comment as key name, or generate one
+                    key_name = parts[2] if len(parts) > 2 else f"{username}-key-{len(authorized_keys)}"
+                    authorized_keys.append({
+                        "name": key_name,
+                        "algorithm": algorithm,
+                        "key-data": key_data
+                    })
+            if authorized_keys:
+                user["authorized-key"] = authorized_keys
 
-        # Skip any records that do not pass YANG validation
-        if (not password_hash or
-            password_hash.startswith('0') or
-            password_hash.startswith('*') or
-            password_hash.startswith('!')):
-            continue
-        user = {}
-        user["name"] = username
-        user["password"] = password_hash
         users.append(user)
 
-
     insert(out, "authentication", "user", users)
 
 def add_clock(out):