matthew/sonic-buildimage
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
202012
sonic-buildimage/rules/tacacs.mk

45 lines
1.4 KiB
Makefile
Raw Permalink Normal View History

[TACACS+]: Add support for TACACS+ Authentication (#1019) * [TACACS+]: Add support for TACACS+ Authentication * pam_tacplus - A TACACS+ protocol client library and PAM module to supports core TACACS+ functions for AAA. * nss_tacplus - A NSS plugin for TACACS+ to extend function getpwnam, make the TACACS+ authenticated user which is not found in local could login successfully. * Add make rules for pam_tacplus and install script * Add a patch for pam_tacplus to disable pam-auth-update pam-tacplus by default * Add a patch for pam_tacplus to inlucde and build nss_tacplus Signed-off-by: chenchen.qcc@alibaba-inc.com * [TACACS+]: Add nss-tacplus as a separate src repo * Separate nss-tacplus from pam-tacplus, modify tacacs.mk and makefile, add a patch to adapt to the new user map profile. * Use the lastest stable version for pam-tacplus, add a dependent package in sonic-salve, add two patches to fix build error. * Add scripts to disable tacplus by default. * Remove hostcfgd service file Signed-off-by: Chenchen Qi <chenchen.qcc@alibaba-inc.com> * [TACACS+]: Fix nss-tacplus filter some valid TACACS+ username * The NAME_REGEX for username check in plugin nss-tacplus is the ANSI version "^[0-9a-zA-Z_-\ ]*$", but the regular expression in /etc/adduser.conf is not defined as ANSI version. To avoid nss-tacplus filter some valid TACACS+ username, remove username check. Signed-off-by: Chenchen Qi <chenchen.qcc@alibaba-inc.com>
2017-12-07 05:36:17 -06:00
# libpam-tacplus packages
PAM_TACPLUS_VERSION = 1.4.1-1
export PAM_TACPLUS_VERSION
[build]: SONiC buildimage ARM arch support (#2980) ARM Architecture support in SONIC make configure platform=[ASIC_VENDOR_ARCH] PLATFORM_ARCH=[ARM_ARCH] SONIC_ARCH: default amd64 armhf - arm32bit arm64 - arm64bit Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2019-07-26 00:06:41 -05:00
LIBTAC2 = libtac2_$(PAM_TACPLUS_VERSION)_$(CONFIGURED_ARCH).deb
[rules/tacacs.mk] Correct package dependencies to ensure successful builds (#2180)
2018-10-30 03:50:13 -05:00
$(LIBTAC2)_SRC_PATH = $(SRC_PATH)/tacacs/pam
SONIC_MAKE_DEBS += $(LIBTAC2)
[build]: SONiC buildimage ARM arch support (#2980) ARM Architecture support in SONIC make configure platform=[ASIC_VENDOR_ARCH] PLATFORM_ARCH=[ARM_ARCH] SONIC_ARCH: default amd64 armhf - arm32bit arm64 - arm64bit Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2019-07-26 00:06:41 -05:00
LIBPAM_TACPLUS = libpam-tacplus_$(PAM_TACPLUS_VERSION)_$(CONFIGURED_ARCH).deb
[TACACS+]: Add support for TACACS+ Authentication (#1019) * [TACACS+]: Add support for TACACS+ Authentication * pam_tacplus - A TACACS+ protocol client library and PAM module to supports core TACACS+ functions for AAA. * nss_tacplus - A NSS plugin for TACACS+ to extend function getpwnam, make the TACACS+ authenticated user which is not found in local could login successfully. * Add make rules for pam_tacplus and install script * Add a patch for pam_tacplus to disable pam-auth-update pam-tacplus by default * Add a patch for pam_tacplus to inlucde and build nss_tacplus Signed-off-by: chenchen.qcc@alibaba-inc.com * [TACACS+]: Add nss-tacplus as a separate src repo * Separate nss-tacplus from pam-tacplus, modify tacacs.mk and makefile, add a patch to adapt to the new user map profile. * Use the lastest stable version for pam-tacplus, add a dependent package in sonic-salve, add two patches to fix build error. * Add scripts to disable tacplus by default. * Remove hostcfgd service file Signed-off-by: Chenchen Qi <chenchen.qcc@alibaba-inc.com> * [TACACS+]: Fix nss-tacplus filter some valid TACACS+ username * The NAME_REGEX for username check in plugin nss-tacplus is the ANSI version "^[0-9a-zA-Z_-\ ]*$", but the regular expression in /etc/adduser.conf is not defined as ANSI version. To avoid nss-tacplus filter some valid TACACS+ username, remove username check. Signed-off-by: Chenchen Qi <chenchen.qcc@alibaba-inc.com>
2017-12-07 05:36:17 -06:00
$(LIBPAM_TACPLUS)_RDEPENDS += $(LIBTAC2)
[rules/tacacs.mk] Correct package dependencies to ensure successful builds (#2180)
2018-10-30 03:50:13 -05:00
$(eval $(call add_extra_package,$(LIBTAC2),$(LIBPAM_TACPLUS)))
[TACACS+]: Add support for TACACS+ Authentication (#1019) * [TACACS+]: Add support for TACACS+ Authentication * pam_tacplus - A TACACS+ protocol client library and PAM module to supports core TACACS+ functions for AAA. * nss_tacplus - A NSS plugin for TACACS+ to extend function getpwnam, make the TACACS+ authenticated user which is not found in local could login successfully. * Add make rules for pam_tacplus and install script * Add a patch for pam_tacplus to disable pam-auth-update pam-tacplus by default * Add a patch for pam_tacplus to inlucde and build nss_tacplus Signed-off-by: chenchen.qcc@alibaba-inc.com * [TACACS+]: Add nss-tacplus as a separate src repo * Separate nss-tacplus from pam-tacplus, modify tacacs.mk and makefile, add a patch to adapt to the new user map profile. * Use the lastest stable version for pam-tacplus, add a dependent package in sonic-salve, add two patches to fix build error. * Add scripts to disable tacplus by default. * Remove hostcfgd service file Signed-off-by: Chenchen Qi <chenchen.qcc@alibaba-inc.com> * [TACACS+]: Fix nss-tacplus filter some valid TACACS+ username * The NAME_REGEX for username check in plugin nss-tacplus is the ANSI version "^[0-9a-zA-Z_-\ ]*$", but the regular expression in /etc/adduser.conf is not defined as ANSI version. To avoid nss-tacplus filter some valid TACACS+ username, remove username check. Signed-off-by: Chenchen Qi <chenchen.qcc@alibaba-inc.com>
2017-12-07 05:36:17 -06:00
[build]: SONiC buildimage ARM arch support (#2980) ARM Architecture support in SONIC make configure platform=[ASIC_VENDOR_ARCH] PLATFORM_ARCH=[ARM_ARCH] SONIC_ARCH: default amd64 armhf - arm32bit arm64 - arm64bit Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2019-07-26 00:06:41 -05:00
LIBTAC_DEV = libtac-dev_$(PAM_TACPLUS_VERSION)_$(CONFIGURED_ARCH).deb
[TACACS+]: Add support for TACACS+ Authentication (#1019) * [TACACS+]: Add support for TACACS+ Authentication * pam_tacplus - A TACACS+ protocol client library and PAM module to supports core TACACS+ functions for AAA. * nss_tacplus - A NSS plugin for TACACS+ to extend function getpwnam, make the TACACS+ authenticated user which is not found in local could login successfully. * Add make rules for pam_tacplus and install script * Add a patch for pam_tacplus to disable pam-auth-update pam-tacplus by default * Add a patch for pam_tacplus to inlucde and build nss_tacplus Signed-off-by: chenchen.qcc@alibaba-inc.com * [TACACS+]: Add nss-tacplus as a separate src repo * Separate nss-tacplus from pam-tacplus, modify tacacs.mk and makefile, add a patch to adapt to the new user map profile. * Use the lastest stable version for pam-tacplus, add a dependent package in sonic-salve, add two patches to fix build error. * Add scripts to disable tacplus by default. * Remove hostcfgd service file Signed-off-by: Chenchen Qi <chenchen.qcc@alibaba-inc.com> * [TACACS+]: Fix nss-tacplus filter some valid TACACS+ username * The NAME_REGEX for username check in plugin nss-tacplus is the ANSI version "^[0-9a-zA-Z_-\ ]*$", but the regular expression in /etc/adduser.conf is not defined as ANSI version. To avoid nss-tacplus filter some valid TACACS+ username, remove username check. Signed-off-by: Chenchen Qi <chenchen.qcc@alibaba-inc.com>
2017-12-07 05:36:17 -06:00
$(LIBTAC_DEV)_DEPENDS += $(LIBTAC2)
$(eval $(call add_derived_package,$(LIBTAC2),$(LIBTAC_DEV)))
# libnss-tacplus packages
NSS_TACPLUS_VERSION = 1.0.4-1
export NSS_TACPLUS_VERSION
[build]: SONiC buildimage ARM arch support (#2980) ARM Architecture support in SONIC make configure platform=[ASIC_VENDOR_ARCH] PLATFORM_ARCH=[ARM_ARCH] SONIC_ARCH: default amd64 armhf - arm32bit arm64 - arm64bit Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2019-07-26 00:06:41 -05:00
LIBNSS_TACPLUS = libnss-tacplus_$(NSS_TACPLUS_VERSION)_$(CONFIGURED_ARCH).deb
[TACACS+]: Add support for TACACS+ Authentication (#1019) * [TACACS+]: Add support for TACACS+ Authentication * pam_tacplus - A TACACS+ protocol client library and PAM module to supports core TACACS+ functions for AAA. * nss_tacplus - A NSS plugin for TACACS+ to extend function getpwnam, make the TACACS+ authenticated user which is not found in local could login successfully. * Add make rules for pam_tacplus and install script * Add a patch for pam_tacplus to disable pam-auth-update pam-tacplus by default * Add a patch for pam_tacplus to inlucde and build nss_tacplus Signed-off-by: chenchen.qcc@alibaba-inc.com * [TACACS+]: Add nss-tacplus as a separate src repo * Separate nss-tacplus from pam-tacplus, modify tacacs.mk and makefile, add a patch to adapt to the new user map profile. * Use the lastest stable version for pam-tacplus, add a dependent package in sonic-salve, add two patches to fix build error. * Add scripts to disable tacplus by default. * Remove hostcfgd service file Signed-off-by: Chenchen Qi <chenchen.qcc@alibaba-inc.com> * [TACACS+]: Fix nss-tacplus filter some valid TACACS+ username * The NAME_REGEX for username check in plugin nss-tacplus is the ANSI version "^[0-9a-zA-Z_-\ ]*$", but the regular expression in /etc/adduser.conf is not defined as ANSI version. To avoid nss-tacplus filter some valid TACACS+ username, remove username check. Signed-off-by: Chenchen Qi <chenchen.qcc@alibaba-inc.com>
2017-12-07 05:36:17 -06:00
$(LIBNSS_TACPLUS)_DEPENDS += $(LIBTAC_DEV)
$(LIBNSS_TACPLUS)_RDEPENDS += $(LIBTAC2)
$(LIBNSS_TACPLUS)_SRC_PATH = $(SRC_PATH)/tacacs/nss
SONIC_MAKE_DEBS += $(LIBNSS_TACPLUS)
[build]: build initramfs, libwrap, tacacs packages under stretch docker initramfs/libwrap/tacacs packages are installed on stretch base image
2018-03-01 03:52:00 -06:00
[202012] [TACACS+] Add audisp-tacplus for per-command accounting. (#8750) (#15788) This pull request integrate audisp-tacplus to SONiC for per-command accounting. ##### Work item tracking - Microsoft ADO **(number only)**: 24433713 #### Why I did it To support TACACS per-command accounting, we integrate audisp-tacplus project to sonic. #### How I did it 1. Add auditd service to SONiC 2. Port and patch audisp-tacplus to SONiC #### How to verify it UT with CUnit to cover all new code in usersecret-filter.c Also pass all current UT. #### Tested branch (Please provide the tested image version) Extract tacacs support functions into library, this will share TACACS config file parse code with other project. Also fix memory leak issue in parse config code. - [ ] SONiC.202012-15723.312602-e230e2d3e #### Description for the changelog Add audisp-tacplus for per-command accounting.
2023-07-12 20:46:47 -05:00
# audisp-tacplus packages
AUDISP_TACPLUS_VERSION = 1.0.2
export AUDISP_TACPLUS_VERSION
AUDISP_TACPLUS = audisp-tacplus_$(AUDISP_TACPLUS_VERSION)_$(CONFIGURED_ARCH).deb
$(AUDISP_TACPLUS)_DEPENDS += $(LIBTAC_DEV)
$(AUDISP_TACPLUS)_RDEPENDS += $(LIBTAC2)
$(AUDISP_TACPLUS)_SRC_PATH = $(SRC_PATH)/tacacs/audisp
SONIC_MAKE_DEBS += $(AUDISP_TACPLUS)
[build]: Added debug symbols to many debug dockers. (#3098) * Added debug symbols to many debug dockers. * For debug images *only*: 1) Archive source files into debug image 2) Archived source is copied into /src 3) Created an empty dir /debug 4) Mount both /src as ro & /debug as rw into every docker 5) Login banner will give some details on /src & /debug 6) Devs can copy core file into /debug and view it from inside a container. 7) Dev may create all gdb logs and other data directly into /debug. * Dropped redundant REDIS_TOOLS per review comments. * Added debug symbols to frr package and hence FRR based BGP docker. * 1) Moved dbg_files.sh to scripts/ 2) Src directories to archive are now collected from individual Makefiles. 3) Added few more debug symbols 4) Added few more debug dockers. Here after no more changes except per review comments. To debug: Install required version of debug image in Switch or VM. Copy core file into /debug of host Get into Docker gdb /usr/bin/<daemon> -c /debug/<your core file> set directory /src/... <-- inside gdb to get the source For non-in-depth debugging: Download corresponding debug Docker image (docker-...-dbg.gz) to your VM Load the image Run image with entrypoint as 'bash' with dir containing core mapped in. Run gdb on the core.
2019-07-04 00:13:55 -05:00
# The .c, .cpp, .h & .hpp files under src/{$DBG_SRC_ARCHIVE list}
# are archived into debug one image to facilitate debugging.
#
DBG_SRC_ARCHIVE += tacacs
Reference in New Issue Copy Permalink