On 9/15/22 12:43, Thomas Lamprecht wrote:
Am 14/09/2022 um 15:42 schrieb Dominik Csapak:
The downside is that we cannot authenticate users anymore without quorum
(since locking requires write access to pmxcfs), even for users without
tfa configured (and also for clusters without any tfa configured at all)
question is more if we should disallow login on unquorate clusters for all
but root@pam, as for all others you cannot be sure if they still got the
permissions and for the pve realm the credentials are still correct, or
if the non-existing TFA entry is still up-to-date (the quorate partition
could have TFA configured for that user since cluster split).
fair point, but then we'd also have to deny api requests in general
for non root@pam users when the cluster is not quorate,
otherwise they can continue making requests with existing tickets
(aside creating a new one)
root@pam is a hard-coded super admin and verified via PAM, which normally
should be pmxcfs, and thus quorum, independent, at least if nobody was crazy
enough to link /etc/shadow to a file in pmxcfs or wrote a PAM that works
on pmxcfs info in other ways.
AFAICS a user can't do anything on a non quorate cluster that wouldn't be
possible
over ssh for example ? since most operations already need the cluster to be
quorate
(aside from things such as network configuration, which might be the exact
reason
why the cluster is not quorate, so the admin/user wants to fix it)
so imho @pam could be allowed in general, but for the other realms it's
very much a design decision.
just to note: before accidentally breaking such logins by locking the tfa
config, we always let users login, regardless of cluster quorum state
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
