summaryrefslogtreecommitdiffstats
path: root/user_channel/user_mgmt.hpp
Commit message (Collapse)AuthorAgeFilesLines
* [Fix]: Check ipmi groups list before creating userRichard Marian Thomaiyar2020-01-231-0/+6
| | | | | | | | | | | | | | | | | | | | | | | When phosphor-user-manager is started later than ipmid, then ipmid misses to get the AvailableGroups list from phosphor-user-manager. Further creation of user through ipmi will end up creating user which doesn't belong to any group at all. This fixes, by making sure, ipmi creates user only if ipmi group is in available groups lists, and will do re-query if it is empty. Tested: 1. Verified the user creation behaviour with having dependency to phosphor-user-manager and without. 2. Manually tested the following. a. Stopped phosphor-user-manager & all ipmi b. Started phosphor-host-ipmid c. started phosphor-user-manager d. using ipmitool user set name created user and verified that it belongs to proper group as expected. Change-Id: I5810babda0e70eb7b6bca577af2031da90dbb068 Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
* [user-mgmt]: Rearrange signal handler registrationarun-pm2020-01-221-1/+2
| | | | | | | | | | | | | | | | | | | Currently, signal handler are registered after the GetManagedObjects query. This may miss any signals generated in-between this time. Correct flow must be to register for the signal first, followed by GetManagedObjects query. Tested: 1. Verified that user list are properly listed after this change. Note: Also, performed following tests to determine the order didn't cause any problem. Verified with both ipmi_user.json deleted and preserved. 2. Started phosphor-user-manager after host-ipmid. 3. Re-started phosphor-user-manager. 4. Started phosphor-host-ipmid after phosphor-user-manager. 5. Restarted phosphor-host-ipmid. Change-Id: I124b5e96672e0456289bca7a2b889e4b897c0545 Signed-off-by: arun-pm <arun.p.m@linux.intel.com>
* user_mgmt:password authentication/update by PAMjayaprakash Mutyala2019-11-101-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Allowed password characters will be handled by password management, instead of set user password command. This makes the checking to be moved from set user password command to pam layer and accordingly throw error, when the same is not valid. Fix: So modified the code to handle with pam module itself. Tested: ipmitool user set password 6 0penBmc1\' Set User Password command successful (user 6) ipmitool user set password 6 0penBmc1\" Set User Password command successful (user 6) ipmitool user set password 6 12345678 //invalid password IPMI command failed: Invalid data field in request Set User Password command failed (user 6) ipmitool user set password 3 asdf1234 //user id does not exit IPMI command failed: Unspecified error Set User Password command failed (user 3) Signed-off-by: jayaprakash Mutyala <mutyalax.jayaprakash@intel.com> Change-Id: Iba6e2c29a927d53e6ebdb5d32e83ecc7cbbd2fd0
* user_layer: Add get/set user payload access.Saravanan Palanisamy2019-07-191-0/+51
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | IPMI Spec reference: Section 24.6, 24.7. Support is added to get/set user access details for the unreserved, supported payload types defined by Spec. SOL is the only unreserved, supported payload currently. If support is needed for unreserved std/oem payload types in future, they can be enabled with minor source code changes to this implementation. All payload types are packed in a JSON object "payload_enabled" in ipmi_user.json file. Tested-by: 1. For user 8 in channel 3, Enable SOL payload. // Command - (channel 3 is of LAN channel type) ipmitool -I lanplus...raw 0x06 0x4C 3 0x8 0x02 0 0 0 // Verify it with Get User Payload Access Command ipmitool -I lanplus...raw 0x06 0x4D 3 8 02 00 00 00 // Response 2. Disable SOL payload. // Command ipmitool -I lanplus...raw 0x06 0x4C 3 0x48 0x02 0 0x00 0 // Verify it with Get User Payload Access Command ipmitool -I lanplus...raw 0x06 0x4D 3 8 00 00 00 00 // Response 3. Enable unsupported payload stdPayload7. // Command ipmitool -I lanplus...raw 0x06 0x4C 3 0x8 0x80 0 0 0 Error: Invalid data field in request // Response Change-Id: Idc57b04a747e55666407d928d8b2169223501e5b Signed-off-by: Saravanan Palanisamy <saravanan.palanisamy@linux.intel.com>
* User-mgmt: Add IPMI user pam authenticate check APIAyushi Smriti2019-06-091-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | PAM user authentication check must be performed, before any RMCP+ session establishment, as this will be able to check whether user is already locked out, due to failed attempt. This patch introduces the pam user check API, which will be used by netipmid daemon. Tested: Verified the API call check and making sure it works. Real testing is performed by including the same in phosphor-ipmi-net for RMCP+ session establishment both for user locked for failed attempt and normal case. Commands used- Created new user using ipmitool ipmitool user set name 2 testuser ipmitool user enable 2 ipmitool user set password 2 pas1tes2 ipmitool user priv 2 4 3 ipmitool user list 3 //New user entry can be seen listed ipmitool channel getaccess 3 2 //For getting channel access ipmitool channel setaccess 3 2 ipmi=on priviledge=4 Normal Case: ipmitool -I lanplus -U testuser -P pas1tes2 -H <bmc ip> raw 6 1 //Command 23 00 00 00 02 bf 57 01 00 7b 00 00 00 00 00 //Response Negative Case: busctl set-property xyz.openbmc_project.User.Manager /xyz/openbmc_project/user xyz.openbmc_project.User.AccountPolicy MaxLoginAttemptBeforeLockout q 3 Tried 3 failed login attempts from webpage, and then tried to establish IPMI RMCP+ as expected, session establishment failed. wait for the timeout or unlock the user using- busctl set-property xyz.openbmc_project.User.Manager /xyz/openbmc_project/user/sayushi xyz.openbmc_project.User.Attributes UserLockedForFailedAttempt b false busctl get-property xyz.openbmc_project.User.Manager /xyz/openbmc_project/user/sayushi xyz.openbmc_project.User.Attributes UserLockedForFailedAttempt b false //Command b false //Response After this RMCP+ session will be established as usual. Change-Id: I5ee2dc0848944a12f682f0775930091d32508bde Signed-off-by: Ayushi Smriti <smriti.ayushi@linux.intel.com>
* remove usage of sdbusplus::message::variantVernon Mauery2019-05-141-1/+2
| | | | | | | | | | | sdbusplus has had its alias of std::variant in place for long enough. This changes all ipmid references to use std::variant directly instead of the sdbusplus alias. Tested-by: building and running ipmid Change-Id: Id5b4136d4589aa598815edd3ef4202e64a7698e2 Signed-off-by: Vernon Mauery <vernon.mauery@linux.intel.com>
* API support to update password for special userRichard Marian Thomaiyar2019-04-221-0/+10
| | | | | | | | | | | | | | | | Provide API support to update password for special user. This API will be used by OEM Command to update the special user password - linux uid 0 (root user). More details can be referred from https://github.com/openbmc/docs/blob/master/user_management.md#deployment---out-of-factory Tested: 1. Verified the API with OEM command implementation, and able to configure the password for user exists in the system /etc/passwd. 2. Verified the negative case for failure Change-Id: I3c2a7007587e52c7e713f0cd976f249dd84a5f75 Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
* Adding Set Password API support in UserlayerSuryakanth Sekar2019-03-261-0/+9
| | | | | | | | | | | | | | | | | | | | Moved the pam function from libusercommand to libuserlayer Added the setPassword API in user layer. There are modules which requires to use set password functionality (other ipmi providers-OEM),so it's better to keep the set-password abstracted in user-layer instead of user-commands. LIBS macro hold libpam and libmapper. we want to separate the libpam from lib usercommand. so,replaced LIBS with libmapper alone. Tested:Able to set the password in ipmi using userlayer. ex: ipmitool user set password <userid> <password> user password should set properly. Change-Id: I32d55ff5c042613c89805c6b9393d18cbf880461 Signed-off-by: Suryakanth Sekar <suryakanth.sekar@linux.intel.com>
* Create libipmid and libipmid-hostWilliam A. Kennington III2019-02-071-1/+1
| | | | | | | | | | | | | | | | | | | This starts a transition to common ipmid libraries that providers can link against. It will allow for a cleaner separation between common ipmid functionality and daemon type specific code. This is needed so we can resolve all of the symbols in the providers at link time instead of discovering bad linkage by building and running a full ipmi daemon. In future commits libraries will be packaged for libipmid and libipmid-host which provide all of the symbols used by the current set of ipmid providers. This is the first step, it just separates and renames the headers. Legacy symlinks are still kept around for compatability. It also adds stub libraries so that external users can start linking as intended. Change-Id: I6bbd7a146362012d26812a7b039d1c4075862cbd Signed-off-by: William A. Kennington III <wak@google.com>
* Doxygen comments for enum & structureRichard Marian Thomaiyar2018-12-191-0/+15
| | | | | | | | | | | Added doxygen comments for enums & structures for user & channel layers. Unit-test: verified build. Change-Id: Ie5af8d6cdd4c04cb396869b7a3dc44f84efedd19 Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
* Update const uint8_t& to const uint8_tRichard Marian Thomaiyar2018-12-111-10/+9
| | | | | | | | | | | | | Update const uint8_t& to const uint8_t usage. Passing by reference for small types are costly than passing it by value and hence the change is done Unit-Test 1. Performed build and verified regular user account creation and RMCP+ login Change-Id: Ic2dd76795749148f82564677dde2a5db08520454 Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
* Add test & user enabled state in set user passwordRichard Marian Thomaiyar2018-11-201-0/+10
| | | | | | | | | | | | Support for test password and user enabled state in Set user password command Unit Test: 1. Performed user enabled & disabled and verified the state change 2. Performed test user password - both pass & fail condition Change-Id: I0eb91ad849e43072b1d9e90d777304fabdfb40bc Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
* Basic IPMI User Management SupportRichard Marian Thomaiyar2018-11-201-0/+295
Squashed commit containing Basic User Management implementation Unit Test: 1. Verified both Host & NetIpmid works fine. 2. Verified user related command responses commit b46b869c0a3958a572b976b3bbaf6b5f33673778 Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com> Date: Tue Aug 7 15:30:32 2018 +0530 Fix static objects to directly link user layer User layer library has to be directly linked with netipmid in order to be used in RAKP commands. Hence user layer library should not initialize the static bus objects in file scope, as ipmid_get_sd_bus_connection() won't be available during this time. Hence moved it under function scope and initialize it later. Unit test: Made sure, with this change it is loaded perfectly under phosphor-ipmi-host & phosphor-ipmi-net and responding to all user commands Change-Id: Id3f2e06580ca41b0347176ca33e011bf7b048c6a Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com> commit dc60516c45234379a30ad8b03b1cbe53978faeae Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com> Date: Tue Aug 7 15:22:37 2018 +0530 Fix to use proper user index for set user name Fix to use proper user index, instead of bailing out on first empty index. If user creation is requested on random index with previous index empty, then signal handler updates the data in first empty index, instead of traversing the user list fully. Fix added to mark the first free index, and still search for match to skip if found. Unit Test: Verified that user added in random index shows in that index using ipmitool set user name command. Change-Id: I30d9b884a5bae98b243ccf8ba7da194ef81355e6 Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com> commit 0b9a81a1261b08ea13ad8777d0d80dad937e9972 Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com> Date: Fri Jul 6 15:57:02 2018 +0530 Converting json store to array for user config Addressed comments to convert to array instead of key value pair. Testing: Performed basic testing of user management commands in both host & netipmid, by repeatedly restarting the same. Change-Id: I2e51ded3e2299fa196d868213950d96c72886358 Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com> commit 182c945657b29acaeb13fc44129e0ed929013e59 Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com> Date: Sat Jun 30 00:07:28 2018 +0530 Fix D-Bus paths for user management Fix D-Bus path as per upstream code in user management Change-Id: Idb22bee4365520f3d58e70ff61b02d6f6512d707 Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com> commit cd5e22b16f8805dda396311b06994a9e021e97e9 Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com> Date: Thu Jun 28 06:22:27 2018 +0530 Json format to store user config & cleanup Code updated to use json format to store and read the user configuration data. Few basic cleanup's performed. Change-Id: I7005f4f2648ccb8214312982a755ddcc6c33e64d Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com> commit 95ca9a67a4b84df603db0eb6a7024e9e0e5ad342 Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com> Date: Wed May 30 15:16:47 2018 +0530 Get & Set User Access command implementation Get & Set User access command implementation Change-Id: I4f7a86de95400387c47ae556127baa1f02a703b2 Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com> commit b2dea762362d06b70576dba5f45552d548792cb9 Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com> Date: Fri May 18 23:46:23 2018 +0530 User layer separation. Separated out user commands from the implementation details, by creating user layers. App Handler library and netipmid will directly rely on this user_layer.so Change-Id: Ie7d4b3a5a934e32da73e066a25da4c27485c59c8 Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com> commit 63e3113e522ecc7ce6e5aa1c85de4dc9b9a65a7b Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com> Date: Mon May 7 12:00:06 2018 +0530 Updated user management ipmi support 1. Relying on Object Manager & D-Bus properties signal (except user rename, for which still relying on user rename signal) 2. Minor clean-up. Change-Id: I594e7823a2c626bb7c88ec54a3ffa89a60b09c65 Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com> commit 3e7b774c842917743369569790612d74387c755e Author: AppaRao Puli <apparao.puli@intel.com> Date: Tue Apr 24 22:01:15 2018 +0530 Synchronize user manager data during ipmi startup Synchronizing the user information by reading all managed user objects from dbus and checking ipmi user data for any update/delete/add users. Change-Id: I9e1a62ec9dd186a7276d083a57e679606d635e05 Signed-off-by: AppaRao Puli <apparao.puli@intel.com> Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com> commit 92298ac0f591d167b0e26b977316a2b136127778 Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com> Date: Tue Apr 24 21:34:08 2018 +0530 Minor fix: Read user enabled state in signals Fixed to read user enabled state in signal handlers. Change-Id: I0aa6c4687c16e08d8e304315e85cb65e9dbd346a Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com> commit 8646d2683fc247ce02a0460f9577276eb6e0a581 Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com> Date: Wed Apr 11 22:18:44 2018 +0530 Signal handler update Support added to handle group, privilege user rename, enable / disable signal, and update the database accordingly. Change-Id: Ia33d063715a35814bbe1f9220e9609b800261e33 Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com> commit fa411b2c4bbef50175b084889a4829206263ebdb Author: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com> Date: Mon Mar 12 23:42:34 2018 +0530 Add Basic user manager support - IPMI Add basic user manager support in IPMI Creates user through D-Bus user interface and sets password using pam_chauthok(). Lock & File reload mechanism also implmeneted. UserUpdate signal handler support added to update user in IPMI, when users are updated through different interfaces. Change-Id: I1adc538562615109189d7c19dadae0b6a109f4a5 Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com> Change-Id: I1adc538562615109189d7c19dadae0b6a109f4a5 Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
OpenPOWER on IntegriCloud