we have something ready to be tested… please jump in it
2 Likes
It seems the SSH+SFTP and Cockpit access is working well. We can release this bundle with the new ShellOverrideStatus prop at disabled, so that existing systems are not affected. In this period of hidden “beta” we can complete the chroot part.
Next steps could be
- Design and add the SFTP chroot feature
- Show a checkbox in the UI, so it’s easy to upgrade to the new behavior. Add documentation to the admin’s manual
- Switch the default prop value to
enabledin NS 7.8
What do you think?
2 Likes
For what I tested it is not so simple, it was not really a goal, so I did not loose much time on it, but in short if you chroot the user to sftp, then the ssh is broken because /bin/bash is no more in the path ( failed to run command ‘/bin/bash’: No such file or directory ). You have some tricks to make it available, but it is a matter to copy libraries to /var/lib/nethserver/home.
To be honest I am not a big fan
agreed
1 Like
A first bundle of the new features was released! See Group-based access restriction for Cockpit and SSH · Issue #6029 · NethServer/dev · GitHub
With the upgraded packages it is possible to preview the new system behavior with the following commands (see README)
do not run in production!
config setprop sssd ShellOverrideStatus enabled
signal-event nethserver-sssd-save
Next step is:
2 Likes
where is the best place for this checkbox :-?
I need a Belgian beer and I need a new angel to watch me at bruxels, last year it was @Sebastian, the night was fun, but it was hard sunday morning
2 Likes
I’d say the Settings page, which is like a trash bin 
1 Like
Yes, it could be easy to find and code it, even if it is not there I could think to find it. From my point of view, the user/group menu could be a better place
Either the modal of the edit the account provider or maybe a checkbox directly in the page menu
Why not in SSH?
Or SFTP do not change port when SSH port is changed?
In fact we introduced a new prop under sssd to force the shell of users to /bin/bash, like this any users could login to cockpit/ssh. For security reasons we also introduce a ssh and cockpit AllowsGroups and restrict who is able to connect
so the question now is where to expose the sssd prop checkbox
I agree. The checkbox just need to be there and checked one time, to upgrade to the new system behavior. New ns 7.8 installations will receive it as default setting.
Meanwhile your latest enhancements were released 
1 Like
