TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-08-13 14:43:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

ssh/tailssh: fall back to using su when no TTY available on Linux

Browse Source 
This allows pam authentication to run for ssh sessions, triggering
automation like pam_mkhomedir.

Updates #11854

Signed-off-by: Percy Wegmann <percy@tailscale.com>
This commit is contained in:
Percy Wegmann
2024-05-29 12:51:50 -05:00
committed by Percy Wegmann
parent f1d10c12ac
commit 08a9551a73
9 changed files with 632 additions and 260 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
ssh/tailssh/incubator_linux.go
View File

@@ -146,11 +146,11 @@ func releaseSession(sessionID string) error {
}
// maybeStartLoginSessionLinux is the linux implementation of maybeStartLoginSession.
func maybeStartLoginSessionLinux(logf logger.Logf, ia incubatorArgs) (func() error, error) {
func maybeStartLoginSessionLinux(dlogf logger.Logf, ia incubatorArgs) func() error {
if os.Geteuid() != 0 {
return nil, nil
return nil
}
logf("starting session for user %d", ia.uid)
dlogf("starting session for user %d", ia.uid)
// The only way we can actually start a new session is if we are
// running outside one and are root, which is typically the case
// for systemd managed tailscaled.
@@ -160,14 +160,14 @@ func maybeStartLoginSessionLinux(logf logger.Logf, ia incubatorArgs) (func() err
// We can look at the DBus GetSessionByPID API.
// https://www.freedesktop.org/software/systemd/man/org.freedesktop.login1.html
// For now best effort is fine.
logf("ssh: failed to CreateSession for user %q (%d) %v", ia.localUser, ia.uid, err)
return nil, nil
dlogf("ssh: failed to CreateSession for user %q (%d) %v", ia.localUser, ia.uid, err)
return nil
}
os.Setenv("DBUS_SESSION_BUS_ADDRESS", fmt.Sprintf("unix:path=%v/bus", resp.runtimePath))
if !resp.existing {
return func() error {
return releaseSession(resp.sessionID)
}, nil
}
}
return nil, nil
return nil
}