HLD for persistent local user management #2018

manoharan-nexthop · 2025-06-17T02:38:06Z

Currently the local users that are created are not persistent across upgrades. This HLD proposes to manage the users across upgrades by storing the configuration in CONFIG_DB and a daemon to manage them in Linux.

Implementation Pull requests:

mssonicbld · 2025-06-17T02:38:13Z

/azp run

azure-pipelines · 2025-06-17T02:38:19Z

No pipelines are associated with this pull request.

mssonicbld · 2025-06-18T14:20:37Z

/azp run

azure-pipelines · 2025-06-18T14:20:44Z

No pipelines are associated with this pull request.

mssonicbld · 2025-06-19T08:16:36Z

/azp run

azure-pipelines · 2025-06-19T08:16:42Z

No pipelines are associated with this pull request.

mssonicbld · 2025-06-19T08:21:30Z

/azp run

azure-pipelines · 2025-06-19T08:21:35Z

No pipelines are associated with this pull request.

mssonicbld · 2025-06-26T05:45:44Z

/azp run

azure-pipelines · 2025-06-26T05:45:50Z

No pipelines are associated with this pull request.

doc/User_Management/User_Management.md

mssonicbld · 2025-07-01T14:40:28Z

/azp run

azure-pipelines · 2025-07-01T14:40:34Z

No pipelines are associated with this pull request.

mssonicbld · 2025-07-01T14:45:52Z

/azp run

azure-pipelines · 2025-07-01T14:45:58Z

No pipelines are associated with this pull request.

mssonicbld · 2025-07-01T14:48:44Z

/azp run

azure-pipelines · 2025-07-01T14:48:50Z

No pipelines are associated with this pull request.

mssonicbld · 2025-07-01T14:49:59Z

/azp run

doc/User_Management/User_Management.md

mssonicbld · 2025-07-17T09:03:20Z

/azp run

azure-pipelines · 2025-07-17T09:03:27Z

No pipelines are associated with this pull request.

This implementation addresses the User Management HLD requirements for centralized user administration in SONiC. sonic-net/SONiC#2018 **1. YANG Model & Configuration Schema:** - Added sonic-user.yang model defining LOCAL_USER and LOCAL_ROLE_SECURITY_POLICY tables - Integrated user management into CONFIG_DB schema with role-based configuration - Added DEVICE_METADATA.local_user_management feature flag **2. User Management Daemon (userd):** - Implemented C++ daemon using SWSS framework for CONFIG_DB integration - Added user lifecycle management (create/update/delete/enable/disable) - Implemented role-based group assignment (administrator, operator roles) - Added SSH key management with proper file permissions - Integrated PAM faillock configuration using Jinja2 templates **3. CLI Interface:** - Extended sonic-utilities with 'config user' and 'show user' commands - Added user import functionality to migrate existing system users - Added role-based user management with proper validation **4. Build System Integration:** - Added sonic-host-services package with userd daemon and systemd service - Integrated user management into SONiC image build process - Added template-based configuration generation for init_cfg.json - Added build dependencies for JSON processing and password hashing

anders-nexthop · 2025-09-17T18:01:23Z

@manoharan-nexthop - Do you have some draft implementation or just HLD changes? If you have any specific details or examples, please share them.

@vitaliibylinka PRs with implementation details have been posted.

mssonicbld · 2025-09-18T04:19:43Z

/azp run

azure-pipelines · 2025-09-18T04:19:49Z

No pipelines are associated with this pull request.

spandan-nexthop

LGTM!
Just added some comments/questions.

doc/User_Management/User_Management.md

arlakshm · 2025-10-08T15:09:16Z

@qiluo-msft can you please help signoff on this feature?

This implementation addresses the User Management HLD requirements for centralized user administration in SONiC. sonic-net/SONiC#2018 nexthop-ai/private-sonic-host-services#54 nexthop-ai/private-sonic-utilities#120 **1. YANG Model & Configuration Schema:** - Added sonic-user.yang model defining LOCAL_USER and LOCAL_ROLE_SECURITY_POLICY tables - Integrated user management into CONFIG_DB schema with role-based configuration - Added DEVICE_METADATA.local_user_management feature flag **2. User Management Daemon (userd):** - Implemented C++ daemon using SWSS framework for CONFIG_DB integration - Added user lifecycle management (create/update/delete/enable/disable) - Implemented role-based group assignment (administrator, operator roles) - Added SSH key management with proper file permissions - Integrated PAM faillock configuration using Jinja2 templates **3. CLI Interface:** - Extended sonic-utilities with 'config user' and 'show user' commands - Added user import functionality to migrate existing system users - Added role-based user management with proper validation **4. Build System Integration:** - Added sonic-host-services package with userd daemon and systemd service - Integrated user management into SONiC image build process - Added template-based configuration generation for init_cfg.json - Added build dependencies for JSON processing and password hashing Tested for all the features that are implemented.

mssonicbld · 2025-11-25T10:22:18Z

/azp run

azure-pipelines · 2025-11-25T10:22:24Z

No pipelines are associated with this pull request.

mssonicbld · 2025-11-25T15:31:37Z

/azp run

azure-pipelines · 2025-11-25T15:31:44Z

No pipelines are associated with this pull request.

venkatmahalingam · 2025-11-26T08:48:28Z

doc/User_Management/User_Management.md

+|:---:|:--------------:|:-----------:|:----------------------------------------------------------------------------------------------------------------------------------------------------:|
+| 1.0 | June 16, 2025  | Manoharan Sundaramoorthy   | Initial HLD                                                                                                                                          |
+
+


Currently the local users that are created are not persistent across upgrades. This HLD proposes to manage the users across upgrades by storing the configuration in CONFIG_DB and a daemon to manage them in Linux.

-> For this requirement, is it not better to migrate the users from one partition to another partition during upgrade operation instead of exposing the users & password keys in the CONFIG_DB, filtering them in the tech bundle for security reasons?

There were few things that we had considered for this:

SSH keys - we would have to create the user directories and the authorized_keys to set this up. It would be possible with scripts but would be cumbersome.

We would not know which were local users and which were from RADIUS / TACACS.

We wont be able to port another device (incase device has to be replaced).

BYGX-wcr · 2025-12-16T23:25:51Z

Password hashes are also considered sensitive data since they can be used for reverse-engineering to get the password. Normally, /etc/shadow is only readable to root-level user. Making this change in SONiC essentially expose the /etc/shadow file content to general users and breaks the security policy of Linux.

BYGX-wcr · 2025-12-16T23:44:38Z

doc/User_Management/User_Management.md

+  - `/etc/sonic/config_db.json` file permissions changed from `644` to `640` (root:redis)
+  - Password hashes only visible in show commands when run with `sudo` privileges
+  - `show user` displays usernames only, `sudo show user` displays hashes
+  - `show runningconfiguration` redacts password_hash fields unless run with `sudo`


What if the user just writes a script/process to connect to the running CONFIG_DB and read content? Right now, there is no table-level protection in redis.

I think currently a user only has to be part of the docker group to view the redis database.

admin@sonic:~$ sudo su - newusername $ groups newusername docker $ redis-cli 127.0.0.1:6379> KEYS * 1) "GEARBOX_TABLE_KEY_SET" 2) "PORT_TABLE:Ethernet96" 3) "PORT_TABLE:Ethernet80" 4) "PORT_TABLE:Ethernet88" 5) "PORT_TABLE:Ethernet16" ...

Can/should this be changed so only users who are part of the redis group can view the db?

aidan-gallagher · 2025-12-17T11:14:03Z

Password hashes are also considered sensitive data since they can be used for reverse-engineering to get the password. Normally, /etc/shadow is only readable to root-level user. Making this change in SONiC essentially expose the /etc/shadow file content to general users and breaks the security policy of Linux.

I believe the CLI show command will only show password hashes when the user is root.
See can_view_passwords in https://github.com/sonic-net/sonic-utilities/pull/4053/files#diff-3311722931fe6ac91c84f68dc5b09d27dbc6624d78e59165e1f0c54564a5b947R29.

I believe the file /etc/sonic/config_db.json is currently world readable

-rw-r--r-- 1 root root 17K Sep 23 09:07 /etc/sonic/config_db.json

And it will need to be changed to this

-rw--r---- 1 root redis 731 Sep 16 14:25 /etc/sonic/config_db.json

I don't see the code to do that in this PR? I would expect something like the following code at the end of generate_config() (
https://github.com/sonic-net/sonic-buildimage/blob/master/files/image_config/config-setup/config-setup#L255)

sudo chmod 640 ${DEST_FILE}
sudo chown root:redis ${DEST_FILE}

manoharan-nexthop force-pushed the user-mgmt branch from bc68d29 to 62d56bc Compare June 18, 2025 14:20

manoharan-nexthop force-pushed the user-mgmt branch from 62d56bc to fd6aea7 Compare June 19, 2025 08:16

manoharan-nexthop force-pushed the user-mgmt branch from fd6aea7 to 7c4b7d3 Compare June 19, 2025 08:21

manoharan-nexthop force-pushed the user-mgmt branch from 7c4b7d3 to 3c56ccb Compare June 26, 2025 05:45

anilpannala added this to SONiC 202511 Release Jun 30, 2025

anilpannala assigned manoharan-nexthop Jun 30, 2025

anilpannala moved this to 📋 In Plan Features in SONiC 202511 Release Jun 30, 2025

bluecmd reviewed Jul 1, 2025

View reviewed changes

doc/User_Management/User_Management.md Show resolved Hide resolved

bluecmd reviewed Jul 1, 2025

View reviewed changes

doc/User_Management/User_Management.md Outdated Show resolved Hide resolved

manoharan-nexthop force-pushed the user-mgmt branch from 3c56ccb to db52f3b Compare July 1, 2025 14:40

manoharan-nexthop force-pushed the user-mgmt branch from db52f3b to 6653490 Compare July 1, 2025 14:45

manoharan-nexthop force-pushed the user-mgmt branch from 6653490 to 793f412 Compare July 1, 2025 14:48

manoharan-nexthop force-pushed the user-mgmt branch from 793f412 to bf17e02 Compare July 1, 2025 14:49

aidan-gallagher reviewed Jul 8, 2025

View reviewed changes

doc/User_Management/User_Management.md Outdated Show resolved Hide resolved

aidan-gallagher reviewed Jul 8, 2025

View reviewed changes

doc/User_Management/User_Management.md Show resolved Hide resolved

aidan-gallagher reviewed Jul 8, 2025

View reviewed changes

doc/User_Management/User_Management.md Outdated Show resolved Hide resolved

doc/User_Management/User_Management.md Show resolved Hide resolved

doc/User_Management/User_Management.md Show resolved Hide resolved

aidan-gallagher reviewed Jul 8, 2025

View reviewed changes

doc/User_Management/User_Management.md Show resolved Hide resolved

manoharan-nexthop force-pushed the user-mgmt branch from 5f08f1c to 4a02cf2 Compare July 17, 2025 09:03

zhangyanzhao moved this from 📋 In Plan Features to 🏗 In Progress in SONiC 202511 Release Aug 12, 2025

This was referenced Sep 8, 2025

feat: Implement comprehensive local user management system sonic-net/sonic-buildimage#23923

Open

feat: Add user management daemon sonic-net/sonic-host-services#309

Open

feat: Add user management CLI commands sonic-net/sonic-utilities#4053

Open

manoharan-nexthop force-pushed the user-mgmt branch from 4a02cf2 to fe06f5f Compare September 18, 2025 04:19

spandan-nexthop reviewed Sep 23, 2025

View reviewed changes

doc/User_Management/User_Management.md Outdated Show resolved Hide resolved

doc/User_Management/User_Management.md Show resolved Hide resolved

doc/User_Management/User_Management.md Show resolved Hide resolved

manoharan-nexthop force-pushed the user-mgmt branch from fe06f5f to cb6b0d2 Compare November 25, 2025 10:22

HLD for persistent local user management

c1032c8

manoharan-nexthop force-pushed the user-mgmt branch from cb6b0d2 to c1032c8 Compare November 25, 2025 15:31

venkatmahalingam reviewed Nov 26, 2025

View reviewed changes

BYGX-wcr reviewed Dec 16, 2025

View reviewed changes

		\|:---:\|:--------------:\|:-----------:\|:----------------------------------------------------------------------------------------------------------------------------------------------------:\|
		\| 1.0 \| June 16, 2025 \| Manoharan Sundaramoorthy \| Initial HLD \|

HLD for persistent local user management #2018

Are you sure you want to change the base?

HLD for persistent local user management #2018

Uh oh!

Conversation

manoharan-nexthop commented Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mssonicbld commented Jun 17, 2025

Uh oh!

azure-pipelines bot commented Jun 17, 2025

Uh oh!

mssonicbld commented Jun 18, 2025

Uh oh!

azure-pipelines bot commented Jun 18, 2025

Uh oh!

mssonicbld commented Jun 19, 2025

Uh oh!

azure-pipelines bot commented Jun 19, 2025

Uh oh!

mssonicbld commented Jun 19, 2025

Uh oh!

azure-pipelines bot commented Jun 19, 2025

Uh oh!

mssonicbld commented Jun 26, 2025

Uh oh!

azure-pipelines bot commented Jun 26, 2025

Uh oh!

Uh oh!

Uh oh!

mssonicbld commented Jul 1, 2025

Uh oh!

azure-pipelines bot commented Jul 1, 2025

Uh oh!

mssonicbld commented Jul 1, 2025

Uh oh!

azure-pipelines bot commented Jul 1, 2025

Uh oh!

mssonicbld commented Jul 1, 2025

Uh oh!

azure-pipelines bot commented Jul 1, 2025

Uh oh!

mssonicbld commented Jul 1, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mssonicbld commented Jul 17, 2025

Uh oh!

azure-pipelines bot commented Jul 17, 2025

Uh oh!

anders-nexthop commented Sep 17, 2025

Uh oh!

mssonicbld commented Sep 18, 2025

Uh oh!

azure-pipelines bot commented Sep 18, 2025

Uh oh!

spandan-nexthop left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

arlakshm commented Oct 8, 2025

Uh oh!

mssonicbld commented Nov 25, 2025

Uh oh!

azure-pipelines bot commented Nov 25, 2025

Uh oh!

mssonicbld commented Nov 25, 2025

Uh oh!

azure-pipelines bot commented Nov 25, 2025

Uh oh!

venkatmahalingam Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

manoharan-nexthop commented Jun 17, 2025 •

edited

Loading

venkatmahalingam Nov 26, 2025 •

edited

Loading