| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
IPMI Spec reference: Section 24.6, 24.7.
Support is added to get/set user access details for the
unreserved, supported payload types defined by Spec.
SOL is the only unreserved, supported payload currently.
If support is needed for unreserved std/oem payload
types in future, they can be enabled with minor source code
changes to this implementation.
All payload types are packed in a JSON object
"payload_enabled" in ipmi_user.json file.
Tested-by:
1. For user 8 in channel 3, Enable SOL payload.
// Command - (channel 3 is of LAN channel type)
ipmitool -I lanplus...raw 0x06 0x4C 3 0x8 0x02 0 0 0
// Verify it with Get User Payload Access Command
ipmitool -I lanplus...raw 0x06 0x4D 3 8
02 00 00 00 // Response
2. Disable SOL payload.
// Command
ipmitool -I lanplus...raw 0x06 0x4C 3 0x48 0x02 0 0x00 0
// Verify it with Get User Payload Access Command
ipmitool -I lanplus...raw 0x06 0x4D 3 8
00 00 00 00 // Response
3. Enable unsupported payload stdPayload7.
// Command
ipmitool -I lanplus...raw 0x06 0x4C 3 0x8 0x80 0 0 0
Error: Invalid data field in request // Response
Change-Id: Idc57b04a747e55666407d928d8b2169223501e5b
Signed-off-by: Saravanan Palanisamy <saravanan.palanisamy@linux.intel.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
PAM user authentication check must be performed, before any RMCP+
session establishment, as this will be able to check whether user
is already locked out, due to failed attempt.
This patch introduces the pam user check API, which will be used by
netipmid daemon.
Tested:
Verified the API call check and making sure it works.
Real testing is performed by including the same in
phosphor-ipmi-net for RMCP+ session establishment both
for user locked for failed attempt and normal case.
Commands used-
Created new user using ipmitool
ipmitool user set name 2 testuser
ipmitool user enable 2
ipmitool user set password 2 pas1tes2
ipmitool user priv 2 4 3
ipmitool user list 3 //New user entry can be seen listed
ipmitool channel getaccess 3 2 //For getting channel access
ipmitool channel setaccess 3 2 ipmi=on priviledge=4
Normal Case:
ipmitool -I lanplus -U testuser -P pas1tes2 -H <bmc ip> raw 6 1
//Command
23 00 00 00 02 bf 57 01 00 7b 00 00 00 00 00 //Response
Negative Case:
busctl set-property xyz.openbmc_project.User.Manager
/xyz/openbmc_project/user xyz.openbmc_project.User.AccountPolicy
MaxLoginAttemptBeforeLockout q 3
Tried 3 failed login attempts from webpage, and then tried to
establish IPMI RMCP+ as expected, session establishment failed.
wait for the timeout or unlock the user using-
busctl set-property xyz.openbmc_project.User.Manager
/xyz/openbmc_project/user/sayushi xyz.openbmc_project.User.Attributes
UserLockedForFailedAttempt b false
busctl get-property xyz.openbmc_project.User.Manager
/xyz/openbmc_project/user/sayushi xyz.openbmc_project.User.Attributes
UserLockedForFailedAttempt b false //Command
b false //Response
After this RMCP+ session will be established as usual.
Change-Id: I5ee2dc0848944a12f682f0775930091d32508bde
Signed-off-by: Ayushi Smriti <smriti.ayushi@linux.intel.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Provide API support to update password for special user.
This API will be used by OEM Command to update the special
user password - linux uid 0 (root user).
More details can be referred from
https://github.com/openbmc/docs/blob/master/user_management.md#deployment---out-of-factory
Tested:
1. Verified the API with OEM command implementation, and able to
configure the password for user exists in the system /etc/passwd.
2. Verified the negative case for failure
Change-Id: I3c2a7007587e52c7e713f0cd976f249dd84a5f75
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Moved the pam function from libusercommand to libuserlayer
Added the setPassword API in user layer.
There are modules which requires to use set password functionality
(other ipmi providers-OEM),so it's better to keep the set-password
abstracted in user-layer instead of user-commands.
LIBS macro hold libpam and libmapper.
we want to separate the libpam from lib usercommand.
so,replaced LIBS with libmapper alone.
Tested:Able to set the password in ipmi using userlayer.
ex: ipmitool user set password <userid> <password>
user password should set properly.
Change-Id: I32d55ff5c042613c89805c6b9393d18cbf880461
Signed-off-by: Suryakanth Sekar <suryakanth.sekar@linux.intel.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This starts a transition to common ipmid libraries that providers can
link against. It will allow for a cleaner separation between common
ipmid functionality and daemon type specific code. This is needed so we
can resolve all of the symbols in the providers at link time instead of
discovering bad linkage by building and running a full ipmi daemon.
In future commits libraries will be packaged for libipmid and libipmid-host
which provide all of the symbols used by the current set of ipmid
providers.
This is the first step, it just separates and renames the headers.
Legacy symlinks are still kept around for compatability. It also adds
stub libraries so that external users can start linking as intended.
Change-Id: I6bbd7a146362012d26812a7b039d1c4075862cbd
Signed-off-by: William A. Kennington III <wak@google.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
User commands updated to handle channel request properly.
1. Self channel number 0xE will be converted properly as per
the interfaces
2. Will handle commands to set / get access for session based
channels only.
Unit-test:
Verfied get / set user access command works on self-channel
and session based channels accordingly. 0xCC will returned
for session-less channels
Change-Id: I91f610e5a70ba648a90191b7aad6ae09d4e0acdc
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
|
|
|
|
|
|
|
|
|
|
|
| |
Added doxygen comments for enums & structures for user & channel
layers.
Unit-test:
verified build.
Change-Id: Ie5af8d6cdd4c04cb396869b7a3dc44f84efedd19
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Update const uint8_t& to const uint8_t usage. Passing by reference
for small types are costly than passing it by value and hence the
change is done
Unit-Test
1. Performed build and verified regular user account creation
and RMCP+ login
Change-Id: Ic2dd76795749148f82564677dde2a5db08520454
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
|
|
|
|
|
|
|
|
|
|
|
|
| |
Support for test password and user enabled state in Set user
password command
Unit Test:
1. Performed user enabled & disabled and verified the state change
2. Performed test user password - both pass & fail condition
Change-Id: I0eb91ad849e43072b1d9e90d777304fabdfb40bc
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Squashed commit containing Basic User Management
implementation
Unit Test:
1. Verified both Host & NetIpmid works fine.
2. Verified user related command responses
commit b46b869c0a3958a572b976b3bbaf6b5f33673778
Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
Date: Tue Aug 7 15:30:32 2018 +0530
Fix static objects to directly link user layer
User layer library has to be directly linked with netipmid
in order to be used in RAKP commands. Hence user layer
library should not initialize the static bus objects in file
scope, as ipmid_get_sd_bus_connection() won't be available
during this time. Hence moved it under function scope and
initialize it later.
Unit test:
Made sure, with this change it is loaded perfectly under
phosphor-ipmi-host & phosphor-ipmi-net and responding to
all user commands
Change-Id: Id3f2e06580ca41b0347176ca33e011bf7b048c6a
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
commit dc60516c45234379a30ad8b03b1cbe53978faeae
Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
Date: Tue Aug 7 15:22:37 2018 +0530
Fix to use proper user index for set user name
Fix to use proper user index, instead of bailing out
on first empty index. If user creation is requested on
random index with previous index empty, then signal
handler updates the data in first empty index, instead of
traversing the user list fully. Fix added to mark the first
free index, and still search for match to skip if found.
Unit Test:
Verified that user added in random index shows in that index
using ipmitool set user name command.
Change-Id: I30d9b884a5bae98b243ccf8ba7da194ef81355e6
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
commit 0b9a81a1261b08ea13ad8777d0d80dad937e9972
Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
Date: Fri Jul 6 15:57:02 2018 +0530
Converting json store to array for user config
Addressed comments to convert to array instead of key
value pair.
Testing: Performed basic testing of user management commands
in both host & netipmid, by repeatedly restarting the same.
Change-Id: I2e51ded3e2299fa196d868213950d96c72886358
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
commit 182c945657b29acaeb13fc44129e0ed929013e59
Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
Date: Sat Jun 30 00:07:28 2018 +0530
Fix D-Bus paths for user management
Fix D-Bus path as per upstream code in user management
Change-Id: Idb22bee4365520f3d58e70ff61b02d6f6512d707
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
commit cd5e22b16f8805dda396311b06994a9e021e97e9
Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
Date: Thu Jun 28 06:22:27 2018 +0530
Json format to store user config & cleanup
Code updated to use json format to store and read
the user configuration data. Few basic cleanup's
performed.
Change-Id: I7005f4f2648ccb8214312982a755ddcc6c33e64d
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
commit 95ca9a67a4b84df603db0eb6a7024e9e0e5ad342
Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
Date: Wed May 30 15:16:47 2018 +0530
Get & Set User Access command implementation
Get & Set User access command implementation
Change-Id: I4f7a86de95400387c47ae556127baa1f02a703b2
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
commit b2dea762362d06b70576dba5f45552d548792cb9
Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
Date: Fri May 18 23:46:23 2018 +0530
User layer separation.
Separated out user commands from the implementation details,
by creating user layers. App Handler library and netipmid
will directly rely on this user_layer.so
Change-Id: Ie7d4b3a5a934e32da73e066a25da4c27485c59c8
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
commit 63e3113e522ecc7ce6e5aa1c85de4dc9b9a65a7b
Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
Date: Mon May 7 12:00:06 2018 +0530
Updated user management ipmi support
1. Relying on Object Manager & D-Bus properties signal (except
user rename, for which still relying on user rename signal)
2. Minor clean-up.
Change-Id: I594e7823a2c626bb7c88ec54a3ffa89a60b09c65
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
commit 3e7b774c842917743369569790612d74387c755e
Author: AppaRao Puli <apparao.puli@intel.com>
Date: Tue Apr 24 22:01:15 2018 +0530
Synchronize user manager data during ipmi startup
Synchronizing the user information by reading
all managed user objects from dbus and checking
ipmi user data for any update/delete/add users.
Change-Id: I9e1a62ec9dd186a7276d083a57e679606d635e05
Signed-off-by: AppaRao Puli <apparao.puli@intel.com>
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
commit 92298ac0f591d167b0e26b977316a2b136127778
Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
Date: Tue Apr 24 21:34:08 2018 +0530
Minor fix: Read user enabled state in signals
Fixed to read user enabled state in signal handlers.
Change-Id: I0aa6c4687c16e08d8e304315e85cb65e9dbd346a
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
commit 8646d2683fc247ce02a0460f9577276eb6e0a581
Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
Date: Wed Apr 11 22:18:44 2018 +0530
Signal handler update
Support added to handle group, privilege
user rename, enable / disable signal, and
update the database accordingly.
Change-Id: Ia33d063715a35814bbe1f9220e9609b800261e33
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
commit fa411b2c4bbef50175b084889a4829206263ebdb
Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
Date: Mon Mar 12 23:42:34 2018 +0530
Add Basic user manager support - IPMI
Add basic user manager support in IPMI
Creates user through D-Bus user interface
and sets password using pam_chauthok().
Lock & File reload mechanism also implmeneted.
UserUpdate signal handler support added to update
user in IPMI, when users are updated through
different interfaces.
Change-Id: I1adc538562615109189d7c19dadae0b6a109f4a5
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
Change-Id: I1adc538562615109189d7c19dadae0b6a109f4a5
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
|
|
|
|
|
|
|
|
|
|
| |
Whenever user is removed from the system, password map in IPMI
database has to be cleaned up. Similarly password entry must
be updated when user rename happens. This commit add's API
changes for the same
Change-Id: I304c721b31fc7fbad019c85d8ca2ecc60ca398d8
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
|
|
|
|
|
|
|
|
|
|
| |
API to Handle the delete password entry from
ipmi-pass encrypted file when user gets deleted
by any interface
Change-Id: I692a81b166b53d6fc981fdb85ce5d6980887560b
Signed-off-by: AppaRao Puli <apparao.puli@intel.com>
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
|
|
Exposes user layer library which will be used by both
apphandler and netipmid for RAKP. Password is decrypted
from the special file which is used by pam-ipmi.
Change-Id: Ia6b99d4359a03843f19cd0e18f7269ad2e3cdb44
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
|