Latest rolling - multiple tacacs user profile locations

phillipmcmahon · July 26, 2023, 10:59pm

Just installed the latest rolling and noticed about 10-15 folders under /home named tacacsxx (xx denotes an incrementing number).

owner is listed as a pid, and the group is tacacs.

Not sure this before, is there a reason for this folder structure to be there? I deleted them all and seemingly with no adverse effect.

Version:          VyOS 1.4-rolling-202307260317
Release train:    current

Built by:         [email protected]
Built on:         Wed 26 Jul 2023 03:17 UTC
Build UUID:       59b6a9d0-da7b-4e31-9bc3-4d61a04fef4f
Build commit ID:  65a930ebef2c2b

Architecture:     x86_64
Boot via:         installed image
System type:      VMware guest

Hardware vendor:  VMware, Inc.
Hardware model:   VMware Virtual Platform
Hardware S/N:     VMware-56 4d 3e ad 00 88 3e 1e-ad f9 49 35 65 7b eb 2e
Hardware UUID:    ad3e4d56-8800-1e3e-adf9-4935657beb2e

Copyright:        VyOS maintainers and contributors```

Apachez · July 27, 2023, 12:04am

I see them too without any tacacs section in my configs, using VyOS 1.4-rolling-202307250317:

root@vyos:~# ls -la /home
total 12
drwxr-xr-x 1 root             root   4096 Jul 25 13:11 .
drwxr-xr-x 1 root             root   4096 Jul 27 01:59 ..
drwx------ 2 radius_user      tacacs   66 Jul 25 05:17 tacacs0
drwx------ 2 radius_priv_user tacacs   66 Jul 25 05:17 tacacs1
drwx------ 2             1010 tacacs   66 Jul 25 05:17 tacacs10
drwx------ 2             1011 tacacs   66 Jul 25 05:17 tacacs11
drwx------ 2             1012 tacacs   66 Jul 25 05:17 tacacs12
drwx------ 2             1013 tacacs   66 Jul 25 05:17 tacacs13
drwx------ 2             1014 tacacs   66 Jul 25 05:17 tacacs14
drwx------ 2             1015 tacacs   66 Jul 25 05:17 tacacs15
drwx------ 2 vyos             tacacs   66 Jul 25 05:17 tacacs2
drwx------ 2             1003 tacacs   66 Jul 25 05:17 tacacs3
drwx------ 2             1004 tacacs   66 Jul 25 05:17 tacacs4
drwx------ 2             1005 tacacs   66 Jul 25 05:17 tacacs5
drwx------ 2             1006 tacacs   66 Jul 25 05:17 tacacs6
drwx------ 2             1007 tacacs   66 Jul 25 05:17 tacacs7
drwx------ 2             1008 tacacs   66 Jul 25 05:17 tacacs8
drwx------ 2             1009 tacacs   66 Jul 25 05:17 tacacs9
drwxr-xr-x 4 vyos             users  4096 Jul 26 21:56 vyos

Apachez · July 27, 2023, 12:13am

Only reference to these accounts seems to be in:

github.com

vyos/vyos-1x/blob/current/src/conf_mode/system-login.py#L61


      
          MIN_USER_UID: int = 1000
          # Maximim UID used when adding system users
          MAX_USER_UID: int = 59999
          # LOGIN_TIMEOUT from /etc/loign.defs minus 10 sec
          MAX_RADIUS_TIMEOUT: int = 50
          # MAX_RADIUS_TIMEOUT divided by 2 sec (minimum recomended timeout)
          MAX_RADIUS_COUNT: int = 25
          # Maximum number of supported TACACS servers
          MAX_TACACS_COUNT: int = 8
          
          
# List of local user accounts that must be preserved
          SYSTEM_USER_SKIP_LIST: list = ['radius_user', 'radius_priv_user', 'tacacs0', 'tacacs1',
                                        'tacacs2', 'tacacs3', 'tacacs4', 'tacacs5', 'tacacs6',
                                        'tacacs7', 'tacacs8', 'tacacs9', 'tacacs10',' tacacs11',
                                        'tacacs12', 'tacacs13', 'tacacs14', 'tacacs15']
          
          
def get_local_users():
              """Return list of dynamically allocated users (see Debian Policy Manual)"""
              local_users = []
              for s_user in getpwall():
                  if getpwnam(s_user.pw_name).pw_uid < MIN_USER_UID:

Also related:

github.com

vyos/vyos-1x/blob/current/data/templates/login/tacplus_nss.conf.j2#L19


      
          #  replies, no other servers are attempted in a given process instantiation
          #
          #  This configuration is similar to the libpam_tacplus configuration, but
          #  is maintained as a configuration file, since nsswitch.conf doesn't
          #  support passing parameters.  Parameters must start in the first
          #  column, and parsing stops at the first whitespace
          
          
# if set, errors and other issues are logged with syslog
          #debug=1
          
          
# min_uid is the minimum uid to lookup via tacacs.  Setting this to 0
          # means uid 0 (root) is never looked up, good for robustness and performance
          # Cumulus Linux ships with it set to 1001, so we never lookup our standard
          # local users, including the cumulus uid of 1000.  Should not be greater
          # than the local tacacs{0..15} uids
          min_uid=900
          
          
# This is a comma separated list of usernames that are never sent to
          # a tacacs server, they cause an early not found return.
          #
          # "*" is not a wild card.  While it's not a legal username, it turns out

github.com

vyos/vyos-1x/blob/current/data/templates/login/tacplus_servers.j2#L49


      
          {% endif %}
          
          
{% if tacacs.source_address is vyos_defined %}
          # Sets the IPv4 address used as the source IP address when communicating with
          # the TACACS+ server. IPv6 addresses are not supported, nor are hostnames.
          # The address must work when passsed to the bind() system call, that is, it must
          # be valid for the interface being used.
          source_ip={{ tacacs.source_address }}
          {% endif %}
          
          
# If user_homedir=1, then tacacs users will be set to have a home directory
          # based on their login name, rather than the mapped tacacsN home directory.
          # mkhomedir_helper is used to create the directory if it does not exist (similar
          # to use of pam_mkhomedir.so). This flag is ignored for users with restricted
          # shells, e.g., users mapped to a tacacs privilege level that has enforced
          # per-command authorization (see the tacplus-restrict man page).
          user_homedir=1
          
          
service=shell
          protocol=ssh

a.hajiyev · July 27, 2023, 8:01am

Hi @phillipmcmahon
The report created
⚓ T5408 15-16 tacacs folders under /home directory
Thank you

phillipmcmahon · July 27, 2023, 8:03am

Thanks a lot. Appreciate you creating the bug report.

Viacheslav · July 27, 2023, 8:56am

It is not a bug.
It is the implementation of TACACS authentication T141: add TACACS support by c-po · Pull Request #2038 · vyos/vyos-1x · GitHub
https://github.com/vyos/vyos-1x/blob/fa07179ae7f1dc07e6ccc1b20d2b81384b6efe07/debian/vyos-1x.postinst#L47-L52

The accounts are not enabled for local login