Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Root home fallback for keep users #47467

Closed

Conversation

eriktate
Copy link
Contributor

@eriktate eriktate commented Oct 10, 2024

This PR falls back to using the root file path as a user's home directory in the case that their expected home directory already exists. This should prevent situations where a user that gets deleted and reprovisioned with a different UID/GID combo is unable to be used as a login for the host.

changelog: Fixed an issue preventing connections when using a newly provisioned host user whose home directory already existed.

Copy link

The PR changelog entry failed validation: Changelog entry not found in the PR body. Please add a "no-changelog" label to the PR, or changelog lines starting with changelog: followed by the changelog entries for the PR.

@eriktate eriktate force-pushed the eriktate/allow-keep-user-creation-without-home branch from badc90c to 65402a6 Compare October 10, 2024 19:55
Copy link
Contributor

@rosstimothy rosstimothy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of modifying the existing users home directory, can we leave it as is, but instead of starting a session in /home/user, start it in / like we seem to already do in some cases: https://github.com/gravitational/teleport/blob/master/lib/srv/reexec.go#L1049-L1064?

@eriktate
Copy link
Contributor Author

Instead of modifying the existing users home directory, can we leave it as is, but instead of starting a session in /home/user, start it in / like we seem to already do in some cases: https://github.com/gravitational/teleport/blob/master/lib/srv/reexec.go#L1049-L1064?

For the path where we potentially convert an existing user into a keep user I could definitely see leaving their home directory alone and I probably should've done that to begin with. I'm not sure why we'd want to create new, managed users with an inaccessible home directory though?

@rosstimothy
Copy link
Contributor

rosstimothy commented Oct 11, 2024

I'm not sure why we'd want to create new, managed users with an inaccessible home directory though?

The end goal is to have the new managed user be created, access to the host to be permitted, and eventually after some manual intervention own the pre-existing home directory. As is stands now with this PR, there is no warning to users that their home directory is/was inaccessible by the newly provisioned user and that we decided to make their home directory / instead. This also now requires a human to manually edit the permissions on the existing home directory and change the user's home directory to get to the desired end state.

@eriktate
Copy link
Contributor Author

Closing this in favor of #47524

@eriktate eriktate closed this Oct 11, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants