Comments (1)
To be a little more explicit on the "fix", I have the following in my VM startup script:
# Allow all actions for members of the sudo group
cat << EOF > /etc/polkit-1/localauthority/50-local.d/46-allow-group-sudo.pkla
[Allow members of sudo group to administer]
Identity=unix-group:sudo
Action=*
ResultAny=yes
EOF
A couple notes:
- This requires that the admin users are part of a local group
sudo
on Debians andwheel
on RedHats I believe. oslogin doesn't currently add admin users to the local admin group so see here: #93 - This is pretty strongly a PolicyKit anti-pattern to disable the password prompt, but when using oslogin you don't have a local password, so I'm not really sure there's any other way.
Additionally, if you use remote desktop, all users will be prompted for a password on login because of Colord, which is a minor annoyance. You disable this prompt (by allowing all users passwordless modification to colord) by adding the following (I don't personally consider this a security risk):
# Allow colord for all users
cat << EOF > /etc/polkit-1/localauthority/50-local.d/45-allow-colord.pkla
[Allow Colord all Users]
Identity=unix-user:*
Action=org.freedesktop.color-manager.create-device;org.freedesktop.color-manager.create-profile;org.freedesktop.color-manager.delete-device;org.freedesktop.color-manager.delete-profile;org.freedesktop.color-manager.modify-device;org.freedesktop.color-manager.modify-profile
ResultAny=no
ResultInactive=no
ResultActive=yes
EOF
from guest-oslogin.
Related Issues (20)
- Log cause of failure in authorized keys utility HOT 2
- Inconsistent state of sudoers file when boot disk fills up
- PAM account function broken in 20230919.00 HOT 36
- sudo access depends upon SSH key registration with OS Login
- Improve error reporting when user has no 2fa methods configured
- bash autocompletion slow HOT 6
- oslogin does not inherit environment build flags (CFLAGS, CXXFLAGS, LDFLAGS).
- Change the login shell of an oslogin user account in non-organizational GCP HOT 3
- Question: Using OS Login from a Bastion for SSH + IAP inside a chroot to second VM in a different project HOT 1
- Segmentation fault (core dumped) while running tests HOT 4
- support configurable metadata server address HOT 1
- Ability to operate outside of GCP HOT 1
- Broken os user after turning on oslogin on instances with metadata based ssh HOT 3
- Pluto pam_oslogin_login issues HOT 1
- os-login and sssd pam modules are incompatible HOT 1
- OSlogin makes chef (ruby) crash HOT 7
- don't segfault if invalid data is returned from metadata server
- Add admin users to posix group HOT 5
- Oslogin cache doesn't prevent requests to metadata HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from guest-oslogin.