| commit | 34d21443ea6ac906308b17bad9606896fff3aa98 | [log] [tgz] |
|---|---|---|
| author | Ninad Palsule <ninadpalsule@us.ibm.com> | Thu Mar 09 10:20:38 2023 -0600 |
| committer | Patrick Williams <patrick@stwcx.xyz> | Fri Apr 21 13:55:15 2023 +0000 |
| tree | 1aff2c723199dd304de32875384afdc843f406b4 | |
| parent | a512e6ec0aa59a5efa87e63d371b7e988ef44ab5 [diff] [blame] |
Changes for new pre-defined usergroup hostconsole The new pre-defined usergroup named "hostconsole" is added to differentiate access between host console and manager console. The only users allowed to interact with host console are part of the "hostconsole" group. This is a fixed is the github issue: https://github.com/openbmc/phosphor-user-manager/issues/15 In commit https://gerrit.openbmc.org/c/openbmc/bmcweb/+/50835 ssh was mapped to both ManagerConsole and HostConsole. The split is discussed in the commit https://gerrit.openbmc.org/c/openbmc/bmcweb/+/50835?tab=comments Note: The changes are spread across multiple repositories listed under "Related commits:" The openbmc changes are as follows: - Removed a dependency on dropbear.default file. Added a new environment file dropbear.env for obmc-console. If we want to add port specific configuration then we can add dropbear.%i.env file. - The DROPBEAR_EXTRA_ARGS variable updated to include "-G hostconsole" flag. - New update script added to add new hostconsole group and also add all users part of the priv-admin group to this new group. - Similarly changes are made to add new group during install time and add root user in this group. Tested: Loaded on system and qemu eumulator. Made sure that the only user can ssh to host console are member of hostconsole group. Related commits: docs: https://gerrit.openbmc.org/c/openbmc/docs/+/60968 phosphor-user-manager: https://gerrit.openbmc.org/c/openbmc/phosphor-user-manager/+/61583 openbmc: https://gerrit.openbmc.org/c/openbmc/openbmc/+/61582 obmc-console: https://gerrit.openbmc.org/c/openbmc/obmc-console/+/61581 bmcweb: https://gerrit.openbmc.org/c/openbmc/bmcweb/+/61580 Change-Id: Icced48da188fb76828bf4ff5c705d6f1300ae3e7 Signed-off-by: Ninad Palsule <ninadpalsule@us.ibm.com>
diff --git a/meta-phosphor/recipes-phosphor/console/obmc-console_git.bb b/meta-phosphor/recipes-phosphor/console/obmc-console_git.bb index 12b1f55..c4f4ee0 100644 --- a/meta-phosphor/recipes-phosphor/console/obmc-console_git.bb +++ b/meta-phosphor/recipes-phosphor/console/obmc-console_git.bb
@@ -17,6 +17,7 @@ SRC_URI = "git://github.com/openbmc/obmc-console;branch=master;protocol=https" SRC_URI += "file://${BPN}.conf" +SRC_URI += "file://dropbear.env" S = "${WORKDIR}/git" SYSTEMD_SERVICE:${PN} += "obmc-console-ssh@.service \ @@ -31,6 +32,9 @@ do_install:append() { # Install the server configuration install -m 0755 -d ${D}${sysconfdir}/${BPN} + + install -m 0644 ${WORKDIR}/dropbear.env ${D}${sysconfdir}/${BPN}/ + # If the OBMC_CONSOLE_TTYS variable is used without the default OBMC_CONSOLE_HOST_TTY # the port specific config file should be provided. If it is just OBMC_CONSOLE_HOST_TTY, # use the old style which supports both port specific or obmc-console.conf method.