From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 114A77303A for ; Wed, 14 Apr 2021 15:30:44 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 03A78F31E for ; Wed, 14 Apr 2021 15:30:44 +0200 (CEST) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [212.186.127.180]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS id 666F5F316 for ; Wed, 14 Apr 2021 15:30:43 +0200 (CEST) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 29A1242236 for ; Wed, 14 Apr 2021 15:30:43 +0200 (CEST) From: Dominik Csapak To: pbs-devel@lists.proxmox.com Date: Wed, 14 Apr 2021 15:30:42 +0200 Message-Id: <20210414133042.19382-1-d.csapak@proxmox.com> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.163 Adjusted score from AWL reputation of From: address KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [user.rs, auth.rs] Subject: [pbs-devel] [PATCH proxmox-backup] api2/access/user: remove password for @pbs users on removal X-BeenThere: pbs-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Backup Server development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Apr 2021 13:30:44 -0000 so that their password entry is not left in the shadow.json Signed-off-by: Dominik Csapak --- src/api2/access/user.rs | 11 +++++++++++ src/auth.rs | 24 ++++++++++++++++++++++++ 2 files changed, 35 insertions(+) diff --git a/src/api2/access/user.rs b/src/api2/access/user.rs index c49b12b1..e080d57a 100644 --- a/src/api2/access/user.rs +++ b/src/api2/access/user.rs @@ -477,6 +477,17 @@ pub fn delete_user(userid: Userid, digest: Option) -> Result<(), Error> user::save_config(&config)?; + let authenticator = crate::auth::lookup_authenticator(userid.realm())?; + match authenticator.remove_password(userid.name()) { + Ok(()) => {}, + Err(err) => { + eprintln!( + "error removing password after deleting user {:?}: {}", + userid, err + ); + } + } + match crate::config::tfa::read().and_then(|mut cfg| { let _: bool = cfg.remove_user(&userid); crate::config::tfa::write(&cfg) diff --git a/src/auth.rs b/src/auth.rs index faad760e..3272dd6d 100644 --- a/src/auth.rs +++ b/src/auth.rs @@ -14,6 +14,7 @@ use crate::api2::types::{Userid, UsernameRef, RealmRef}; pub trait ProxmoxAuthenticator { fn authenticate_user(&self, username: &UsernameRef, password: &str) -> Result<(), Error>; fn store_password(&self, username: &UsernameRef, password: &str) -> Result<(), Error>; + fn remove_password(&self, username: &UsernameRef) -> Result<(), Error>; } pub struct PAM(); @@ -60,6 +61,11 @@ impl ProxmoxAuthenticator for PAM { Ok(()) } + + // do not remove password for pam users + fn remove_password(&self, _username: &UsernameRef) -> Result<(), Error> { + Ok(()) + } } pub struct PBS(); @@ -132,6 +138,24 @@ impl ProxmoxAuthenticator for PBS { Ok(()) } + + fn remove_password(&self, username: &UsernameRef) -> Result<(), Error> { + let mut data = proxmox::tools::fs::file_get_json(SHADOW_CONFIG_FILENAME, Some(json!({})))?; + if let Some(map) = data.as_object_mut() { + map.remove(username.as_str()); + } + + let mode = nix::sys::stat::Mode::from_bits_truncate(0o0600); + let options = proxmox::tools::fs::CreateOptions::new() + .perm(mode) + .owner(nix::unistd::ROOT) + .group(nix::unistd::Gid::from_raw(0)); + + let data = serde_json::to_vec_pretty(&data)?; + proxmox::tools::fs::replace_file(SHADOW_CONFIG_FILENAME, &data, options)?; + + Ok(()) + } } /// Lookup the autenticator for the specified realm -- 2.20.1