Debian Bug report logs - #779880
adduser: deluser should delete users from AllowUsers field in sshd_config

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Eric Light <it@forlongs.co.nz>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: adduser: deluser should delete users from AllowUsers field in sshd_config

Date: Fri, 06 Mar 2015 10:48:13 +1300

Package: adduser
Version: 3.113+nmu3
Severity: wishlist

Dear Maintainer,

In trying to optimise SSH security, I've limited our incoming users with the AllowUsers field in /etc/ssh/sshd_config.

When running 'deluser test', the test user still exists as an entry in AllowUsers.

When deleting a user, it would be good if the deleted user entry were also deleted from this location.

Alternatively, if the AllowUsers field appears to be in use, a warning message after the deletion of the user, to remind the system administrator to tidy up sshd_config.  :)

Thanks,
Eric


-- System Information:
Debian Release: 7.8
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.2.0-4-amd64 (SMP w/1 CPU core)
Locale: LANG=en_NZ.UTF-8, LC_CTYPE=en_NZ.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages adduser depends on:
ii  debconf [debconf-2.0]  1.5.49
ii  passwd                 1:4.1.5.1-1
ii  perl-base              5.14.2-21+deb7u2

adduser recommends no packages.

Versions of packages adduser suggests:
ii  liblocale-gettext-perl  1.05-7+b1
ii  perl-modules            5.14.2-21+deb7u2

-- debconf information:
  adduser/homedir-permission: true
  adduser/title:

Message #10 received at 779880-done@bugs.debian.org (full text, mbox, reply):

From: Stephen Gran <sgran@debian.org>

To: Eric Light <it@forlongs.co.nz>, 779880-done@bugs.debian.org

Subject: Re: [Adduser-devel] Bug#779880: adduser: deluser should delete users from AllowUsers field in sshd_config

Date: Sun, 8 Mar 2015 09:32:21 +0000

[Message part 1 (text/plain, inline)]

Hi,

This one time, at band camp, Eric Light said:
> Dear Maintainer,
> 
> In trying to optimise SSH security, I've limited our incoming users
> with the AllowUsers field in /etc/ssh/sshd_config.
> 
> When running 'deluser test', the test user still exists as an entry in
> AllowUsers.
> 
> When deleting a user, it would be good if the deleted user entry were
> also deleted from this location.
> 
> Alternatively, if the AllowUsers field appears to be in use, a warning
> message after the deletion of the user, to remind the system
> administrator to tidy up sshd_config.  :)

I'm afraid that what you're asking for would be a violation of Debian
policy.  What I might do in your shoes to replicate such functionality
would be to create /usr/local/bin/deluser.local with the functionality
you ask for.  Or move to adding users to an 'sshuser' group and managing
it that way.

Cheers,
-- 
 -----------------------------------------------------------------
|   ,''`.                                            Stephen Gran |
|  : :' :                                        sgran@debian.org |
|  `. `'                        Debian user, admin, and developer |
|    `-                                     http://www.debian.org |
 -----------------------------------------------------------------

[signature.asc (application/pgp-signature, inline)]

Message #11 received at 779880-done@bugs.debian.org (full text, mbox, reply):

From: Eric Light <IT@forlongs.co.nz>

To: 'Stephen Gran' <sgran@debian.org>, "779880-done@bugs.debian.org" <779880-done@bugs.debian.org>

Subject: RE: [Adduser-devel] Bug#779880: adduser: deluser should delete users from AllowUsers field in sshd_config

Date: Sun, 8 Mar 2015 20:29:08 +0000

Aha, I see.  Thanks Stephen, I'll follow your advice re the 'sshuser' group.  :)

-----Original Message-----
From: Stephen Gran [mailto:sgran@debian.org] 
Sent: Sunday, 8 March 2015 10:32 p.m.
To: Eric Light; 779880-done@bugs.debian.org
Subject: Re: [Adduser-devel] Bug#779880: adduser: deluser should delete users from AllowUsers field in sshd_config

Hi,

This one time, at band camp, Eric Light said:
> Dear Maintainer,
> 
> In trying to optimise SSH security, I've limited our incoming users 
> with the AllowUsers field in /etc/ssh/sshd_config.
> 
> When running 'deluser test', the test user still exists as an entry in 
> AllowUsers.
> 
> When deleting a user, it would be good if the deleted user entry were 
> also deleted from this location.
> 
> Alternatively, if the AllowUsers field appears to be in use, a warning 
> message after the deletion of the user, to remind the system 
> administrator to tidy up sshd_config.  :)

I'm afraid that what you're asking for would be a violation of Debian policy.  What I might do in your shoes to replicate such functionality would be to create /usr/local/bin/deluser.local with the functionality you ask for.  Or move to adding users to an 'sshuser' group and managing it that way.

Cheers,
--
 -----------------------------------------------------------------
|   ,''`.                                            Stephen Gran |
|  : :' :                                        sgran@debian.org |
|  `. `'                        Debian user, admin, and developer |
|    `-                                     http://www.debian.org |
 -----------------------------------------------------------------

Send a report that this bug log contains spam.