blob: a82f62c55d0d00b405ce54d33252958df1fc9407 [file] [log] [blame]
Adriana Kobylakb96c7502021-08-06 16:25:30 +00001OBMC_IMAGE_EXTRA_INSTALL:append:ibm-ac-server = " mboxd max31785-msl phosphor-msl-verify liberation-fonts uart-render-controller first-boot-set-hostname"
Andrew Geissler0a9a5672023-04-03 10:07:44 -06002OBMC_IMAGE_EXTRA_INSTALL:remove:witherspoon-tacoma = " liberation-fonts uart-render-controller"
Andrew Geissler0c3e5ee2021-12-17 19:30:02 +00003OBMC_IMAGE_EXTRA_INSTALL:append:p10bmc = " mboxd"
ojayanthcc730392023-05-21 23:13:15 -05004OBMC_IMAGE_EXTRA_INSTALL:append:p10bmc-distributed = " etcd"
Andrew Geisslerd1b5b202021-01-04 12:16:39 -06005
Patrick Williamsc0201c92022-04-18 14:29:31 -05006IMAGE_FEATURES:append = " obmc-dbus-monitor"
7
Andrew Geisslerd1b5b202021-01-04 12:16:39 -06008# remove so things fit in available flash space
Adriana Kobylakb96c7502021-08-06 16:25:30 +00009IMAGE_FEATURES:remove:witherspoon = "obmc-user-mgmt-ldap"
Andrew Geissler3475f832021-08-12 09:09:41 -040010IMAGE_FEATURES:remove:witherspoon = "obmc-telemetry"
Joseph Reynolds68e567f2021-02-24 17:20:01 -060011
Andrew Geissler0f80cda2021-08-31 15:50:20 -050012# Generic IPMI FRU vpd collection not needed on p10bmc
13IMAGE_FEATURES:remove:p10bmc = "obmc-fru-ipmi"
14
Joseph Reynolds68e567f2021-02-24 17:20:01 -060015# Optionally configure IBM service accounts
16#
17# To configure your distro, add the following line to its config:
18# DISTRO_FEATURES += "ibm-service-account-policy"
19#
20# The service account policy is as follows:
21# root - The root account remains present. It is needed for internal
22# accounting purposes and for debugging service access.
23# admin - Provides administrative control over the BMC. The role is
24# SystemAdministrator. Admin users have access to interfaces including:
25# Redfish, REST APIs, Web. No access to the BMC via: the BMC's physical
26# console, SSH to the BMC's command line.
27# IPMI access is not granted by default, but admins can authorize
28# themselves and enable the IPMI service.
29# The admin has access to the host console: ssh -p2200 admin@${bmc}.
30# The admin account does not have a home directory.
31# service - Provides IBM service and support representatives (SSRs, formerly
32# known as customer engineers or CEs) access to the BMC. The role is
33# OemIBMServiceAgent. The service user has full admin access, plus access
34# to BMC interfaces intended only to service the BMC and host, including
35# SSH access to the BMC's command line.
36# The service account is not authorized to IPMI because of the inherent
37# security weakness in the IPMI spec and also because the IPMI
38# implementation was not enhanced to use the ACF support.
39# The service account does not have a home directory. The home directory is
40# set to / (the root directory) to allow dropbear ssh connections.
41
Joseph Reynolds516363e2021-08-04 10:01:42 -050042# Override defaults from meta-phosphor/conf/distro/include/phosphor-defaults.inc
Joseph Reynolds68e567f2021-02-24 17:20:01 -060043
Joseph Reynolds68e567f2021-02-24 17:20:01 -060044#IBM_EXTRA_USERS_PARAMS += " \
Joseph Reynolds356f9e12021-07-23 20:15:32 -050045# usermod -p ${DEFAULT_OPENBMC_PASSWORD} root; \
Joseph Reynolds68e567f2021-02-24 17:20:01 -060046# "
47
48# Add group "wheel" (before adding the "service" account).
49IBM_EXTRA_USERS_PARAMS += " \
50 groupadd wheel; \
51 "
52
53# Add the "admin" account.
54IBM_EXTRA_USERS_PARAMS += " \
Ravi Tejac76c5582023-08-03 12:03:17 -050055 useradd --groups priv-admin,redfish,web -s /sbin/nologin admin; \
Joseph Reynolds356f9e12021-07-23 20:15:32 -050056 usermod -p ${DEFAULT_OPENBMC_PASSWORD} admin; \
Joseph Reynolds68e567f2021-02-24 17:20:01 -060057 "
58
59# Add the "service" account.
60IBM_EXTRA_USERS_PARAMS += " \
61 useradd -M -d / --groups priv-admin,redfish,web,wheel service; \
Joseph Reynolds356f9e12021-07-23 20:15:32 -050062 usermod -p ${DEFAULT_OPENBMC_PASSWORD} service; \
Joseph Reynolds68e567f2021-02-24 17:20:01 -060063 "
64
65# This is recipe specific to ensure it takes effect.
Adriana Kobylakb96c7502021-08-06 16:25:30 +000066EXTRA_USERS_PARAMS:pn-obmc-phosphor-image += "${@bb.utils.contains('DISTRO_FEATURES', 'ibm-service-account-policy', "${IBM_EXTRA_USERS_PARAMS}", '', d)}"
Joseph Reynolds68e567f2021-02-24 17:20:01 -060067
68# The service account needs sudo.
Adriana Kobylakb96c7502021-08-06 16:25:30 +000069IMAGE_INSTALL:append = " ${@bb.utils.contains('DISTRO_FEATURES', 'ibm-service-account-policy', 'sudo', '', d)}"