forked from linux/documentation
65 lines
2.2 KiB
Markdown
65 lines
2.2 KiB
Markdown
# Regular and Administrative User Access
|
|
|
|
|
|
## Regular Access
|
|
Access for ActiveDirectory (AD) user accounts or groups:
|
|
```
|
|
aaa::users:
|
|
- 'muster_h'
|
|
- '%unx-project_group'
|
|
```
|
|
Groups are allowed with the `%` prefix in front of the group name.
|
|
|
|
To limit a login to the physical desktop/console only you can add an full [access.conf](https://man7.org/linux/man-pages/man5/access.conf.5.html) line with a `LOCAL` restriction like this:
|
|
```
|
|
aaa::users:
|
|
- '+:muster_h:LOCAL'
|
|
```
|
|
|
|
Note that administrative users (see below) always have normal access without being explicitly listed in `aaa::users`.
|
|
|
|
## Allow Access for External, Global, Experiment or Service Accounts
|
|
- `aaa::allow_external_accounts: true` allows for external accounts
|
|
- `aaa::allow_global_accounts: true` allows for global accounts
|
|
- `aaa::allow_experiment_accounts: true` allows for [experiment accounts](eaccounts)
|
|
- `aaa::allow_service_accounts: true` allow logins of service accounts
|
|
|
|
Note that individual users of these groups additionally need to be added to one of `aaa::users` or `aaa::admins` to actually get access to a system.
|
|
|
|
## Use Special User List
|
|
|
|
If you need to use a different user list on a special system that differs from the user list that is defined toplevel this can be done like this:
|
|
|
|
```yaml
|
|
# Disable login on this machine except for specified users
|
|
aaa::userlist_name: custom
|
|
aaa::userlist::custom:
|
|
- muster_h
|
|
```
|
|
|
|
With this not the users from `aaa::users` but `aaa::userlist:custom` is used to set the systems user list. `custom` can be any arbitrary name.
|
|
|
|
## Administrative (root/sudo) Access
|
|
To give root access for AD user accounts or groups via sudo.
|
|
```
|
|
aaa::admins:
|
|
- 'muster_h'
|
|
- '%unx-project_admins'
|
|
```
|
|
|
|
## Administrative Rights on Desktop (polkit/group `wheel`)
|
|
|
|
To give users administrative rights on the desktop to e.g. install software using the `Software` tool, list them in Hiera in `desktop::priv_users`:
|
|
```
|
|
desktop::priv_users:
|
|
- 'doe_j'
|
|
- '%unx-project_group'
|
|
```
|
|
|
|
This is implemented by adding the user/group to the `wheel` group and having [`polkit`](https://www.freedesktop.org/software/polkit/docs/latest/polkit.8.html) policies allowing certain actions.
|
|
|
|
Note that all users of `aaa::admins` are added automatically to the group `wheel`.
|
|
|
|
|
|
|