- Add sshd 'UsePAM yes'
- Buildroot automatically adds and enables:
- /etc/pam.d/ with authentication for login, sshd, and sudo
- PAM support in BusyBox login
Also, prepare for adding RADIUS authentication support to ietf-system
the only tricky part is testing against a RADIUS server.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This fixes a serious security regression introduced late in the v24.04
release cycle. The root cause is the placement of the shadow file in
the rootfs overlay, which causes any changes made by the Buildroot
setting BR2_TARGET_ENABLE_ROOT_LOGIN to be discarded/overwritten just
before creating the squashfs image.
The fix in this commit relocates all files from b4eb450 to the skeleton
in Infix, package/skeleton-init-finit/skeleton/etc, which is one of the
first packages to be installed when starting a build.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Free up 'operator' and 'staff' groups for NETCONF use
- Reserve 'backup' user and group for future auto-backup (Debian)
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Even though dnsmasq only listened to requests from 127.0.0.1, port 53
was visible using nmap. We only use dnsmasq as a local resolver, so
we can safely change the config to bind to loopback instead, and at
the same time get less noise from nmap scans.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Relocate all nginx .conf files to board/common/rootfs/etc/nginx/ and
introduce available/*.conf with symlinks to enabled/*.conf
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds an initial YANG model for Infix web services under the
infix-services.yang umbrella. For now the nginx server statements in
/etc/nginx/nginx.conf are always on, but the backend ttyd, and the
entire nginx server can be disabled.
The default in the YANG model for both is disabled, the factory-config
has been updated to enable these services by default.
The Web Console Interface mDNS service has been updated to advertise
on port 7681, which nginx is set to forward to ttyd.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With Classic builds out of the way we can move everything back to common
again to simplify and reduce our collective cognitive overhead a bit.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the changes in 9847a8f we can keep the /etc/motd file with a proper
newline at EOF so that also Classic builds make sense.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Sending SIGTERM to conmon is not a safe shutdown of a podman container.
To handle gracefully handle shutdown, restarting and provide an orderly
start of dependencies, we use the Finit sysv trick via container script
wrapper to call 'podman stop foo'.
However, since podman does not support syslog as output for containers
we employ an old FIFO trick with another program, k8s-logger, to allow
logs to reach syslog. Please note that k8s-logger must have properly
started before we call `podman start` -- this makes us fully dependent
on the 'container' wrapper script. Hence the documentation update.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Install the sudo command, and let all members of the "wheel" group run
any command as the superuser.
This ensures that administrators have full access to the system,
primarily for troubleshooting, diagnostics, and remote scripting
purposes.
Move from everything in a single /etc/chrony.conf to a split up with
configuration and server snippets. The latter comes in the form of
configured (static) and DHCP client (dynamic) server setup.
To accomodate this new scheme we need to detect when serves are removed
from the configuration, so not only have the whole change_ntp() been
refactored, it has been extended with a new pass.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The bootstrap script gets feedback from gen-admin-auth, on error we no
longer bail out but instead log the error and continue booting. This
way a developer build with root login can diagnose the error.
When logging the error we also set /etc/issue, /etc/issue.net for local
and remote login services, as well as the dedicated /etc/banner used by
OpenSSH, to hold the error summary. So when attaching to the console
port, or attempting to log in remotely with SSH, the error is printed
to indicate the device is not healthy.
Finally, since factory-config may be missing we need to bootstrap the
sysrepo db with something else, and fortunately we will always have a
failure-config to fall back on.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Currently does not need any conditions, but may later need to check for
loaded modules and other capabilities.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead, use the version from package/skeleton-init-finit, including the
ssh-hostkeys (previously ssh-genhostkeys) from the same package, because
it include extensive error handling and logging on failure.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Set the IP origin "random" for avahi IPv4LL addresses. The reason we
use random and not link-layer for link-local IPv4 addresses is the
fact that they are not based on link-layer info, such as IPv6 eui64
generated LL addresses.
Signed-off-by: Richard Alpe <richard@bit42.se>
Add a pristine copy of the current version of avahi-autoipd.action.
This script will be modified by us in later commits.
Signed-off-by: Richard Alpe <richard@bit42.se>
This file is read by iproute2 and creates valid names for ip proto.
Such as "static" in:
ip addr add dev e0 192.168.1.1/24 proto static
Signed-off-by: Richard Alpe <richard@bit42.se>
