8000 Using OPNsense as jumphost for non-admin users no longer works · Issue #8721 · opnsense/core · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Using OPNsense as jumphost for non-admin users no longer works #8721

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
2 tasks done
davidolrik opened this issue May 25, 2025 · 6 comments
Closed
2 tasks done

Using OPNsense as jumphost for non-admin users no longer works #8721

davidolrik opened this issue May 25, 2025 · 6 comments
Assignees
@AdSchellevis
Labels
cleanup Low impact changes

Comments

@davidolrik
Copy link

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

Describe the bug

Non-admin users with /usr/sbin/nologin as shell can no longer use OPNsense as ssh jumphost, as group memberships are no longer synced to the unix groups.
Admin users are always in the wheel group so they are can still use OPNsense as ssh jumphost.

To Reproduce

  1. Create an additional user group called ssh
  2. Go to "System->Settings->Administration->Secure shell->Login group" and select wheel, ssh in the dropdown
  3. Create a non-admin user with /usr/sbin/nologin as shell
  4. Put new user in ssh group
  5. ssh as admin to the firewall, do id <non-admin-user>, notice user is not in the ssh group
  6. Try to ssh to a host on the internal network as the non-admin-user using the firewall as jumphost, notice the permission denied error
  7. Work-around: sudo pw group mod ssh -m <non-admin-user>, try ssh to a host on the internal network, notice it works

Expected behavior

When adding users to a group in the UI it should be mirrored in the unix groups, so tools like ssh can pickup on it.

Describe alternatives you considered

Can't think of any alternatives, only work-arounds or setting up a secondary jumphost on the internal network and port forwarding to it.

Environment

OPNsense 25.1.7_4-amd64
FreeBSD 14.2-RELEASE-p3
OpenSSL 3.0.16
@fichtner
Copy link
Member

Internal and external audits always complained about non-admin users allowing shell access Even if this is a configuration mistake and is obviously never set by default. Only admins are allowed unix users including shell access therefore.

@fichtner fichtner added the support Community support label May 25, 2025
@davidolrik
Copy link
Author

Even if with shell /usr/sbin/nologin ?

This effectively means only admins can use OPNsense as a jumphost, which might push people to make everyone an admin, which I think is way worse.

@fichtner
Copy link
Member

If the user doesn’t have a shell it makes no sense to offer the user to the Unix system.

I think you are arguing from your use case perspective, which is fine. The bigger picture is clearer: you own making your users admins, or find a better way to your original use case.

@davidolrik
Copy link
Author

It make perfect sense, as you can still use the ssh daemon for jumping to a host on the internal network - no shell needed.

But if this is the stance of the project, then the option in "System->Settings->Administration->Secure shell->Login group" should be removed as it makes no sense to add an additional login group as wheel can't be removed and the additional is not added to any user, not even the admins.

@AdSchellevis
Copy link
Member

removing the login group might be an option indeed, I don't think there's a use for it anymore. As @fichtner mentioned, for compliance reasons we removed the shell option for non admin users quite some time ago (a0581ae)

@davidolrik
Copy link
Author

Definitely remove it - it is confusing to have there - It suggests that the behaviour I'm looking for is still supported.

I'll spin up a separate jump host for each OPNsense install I have, as I don't want everyone with jump host privil 8A1C eges to be a firewall admin.

AdSchellevis added a commit that referenced this issue May 25, 2025
@AdSchellevis
System: Settings: Administration - remove 'sshlogingroup' which was m…
160c393 
…ore or less deprecated by a0581ae, closes #8721
@AdSchellevis AdSchellevis self-assigned this May 25, 2025
@AdSchellevis AdSchellevis added cleanup Low impact changes and removed support Community support labels May 25, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@AdSchellevis AdSchellevis

Labels
cleanup Low impact changes
Milestone
No milestone
Development

No branches or pull requests
3 participants
@davidolrik @fichtner @AdSchellevis
0