Correct and improve stricter ssh and doas access #34

New issue

Closed

opened 2020-07-23 15:13:06 +02:00 by jdubois · 1 comment

jdubois commented

2020-07-23 15:13:06 +02:00

Member

Commit 8b1ce861e3 added stricter ssh and doas access, and was improved by commit 10d56cad1e.

But there are some problems and questions :

Why are the groups name evolinux-xxx ? We should name them evobsd-xxx.
The evolinux-sudo group is not used in sudoers file but in doas.conf. It should be named evobsd-doas.
Since we use doas in place of sudo, we should remove the evomaintenance configuration in the sudo configuration.
Are theses groups made for every users, namely Evolix users and clients, or are they made only for Evolix users ?
If they are made only for Evolix users, then how do we allow clients to ssh or to use evomaintenance on their servers ?
Shouldn't we have only one group instead of a ssh and a sudo group, since each added users will necessarily be in both groups ?
Is the wheel group still expected to be used ?

Commit 8b1ce861e3a95bd532c82bebb295c42afec5ffdb added stricter ssh and doas access, and was improved by commit 10d56cad1ea2e1a21ab7fa66874492785cb8bf19. But there are some problems and questions : * Why are the groups name `evolinux-xxx` ? We should name them `evobsd-xxx`. * The `evolinux-sudo` group is not used in sudoers file but in doas.conf. It should be named `evobsd-doas`. * Since we use doas in place of sudo, we should remove the evomaintenance configuration in the sudo configuration. * Are theses groups made for every users, namely Evolix users and clients, or are they made only for Evolix users ? * If they are made only for Evolix users, then how do we allow clients to ssh or to use evomaintenance on their servers ? * Shouldn't we have only one group instead of a ssh and a sudo group, since each added users will necessarily be in both groups ? * Is the wheel group still expected to be used ?

Ghost commented

2020-07-23 16:53:00 +02:00

Yes, it was a mistake to import these evolinux-xxx groups from Evolinux.

For me, these groups are exclusives to Evolix users. We should just replace them by a single evolix group. That would make more sense to me...

Evolix users should still be part of the wheel group but I think it's more natural to rely on a specific evolix group for SSH and sudo/doas rights. In doing so every sysadmin - not necessarily familiarised with OpenBSD and the wheel group - will understand straight away.

If for some reason a client needs to connect to an OpenBSD system, then we would create a group named after the client name and add it in the SSH configuration.

Yes, it was a mistake to import these evolinux-xxx groups from Evolinux. For me, these groups are exclusives to Evolix users. We should just replace them by a single evolix group. That would make more sense to me... Evolix users should still be part of the wheel group but I think it's more natural to rely on a specific evolix group for SSH and sudo/doas rights. In doing so every sysadmin - not necessarily familiarised with OpenBSD and the wheel group - will understand straight away. If for some reason a client needs to connect to an OpenBSD system, then we would create a group named after the client name and add it in the SSH configuration.