[GH-ISSUE #17] Comments on servers are not visible to users added via group-guest on selfListAccesses #6

New issue

Closed

opened 2026-05-07 00:17:07 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-07 00:17:07 +02:00

Owner

Originally created by @rbeuque74 on GitHub (Oct 26, 2020).
Original GitHub issue: https://github.com/ovh/the-bastion/issues/17

I have a group, with 4 servers, some of them have userComment on it:

poweruser@zbst-rbeuque(master)> groupListServers --group foo
---zbst-rbeuque--------------------------------the-bastion-2.99.99-rc9.4-ovh1---
=> list of servers pertaining to the group
--------------------------------------------------------------------------------
~ IP               PORT                 USER                      ACCESS-BY   ADDED-BY      ADDED-AT                                       EXPIRY?                                  COMMENT FORCED-KEY?                                                                                                                                                            
~ 127.0.0.1          22                  ovh                     foo(group)  poweruser    2020-10-26                                             -                                        - -                                                                                                                                                                      
~ 127.0.0.2          22                  ovh                     foo(group)  poweruser    2020-10-26                                             -                             test comment -                                                                                                                                                                      
~ 127.0.0.3          22                  ovh                     foo(group)  poweruser    2020-10-26                                             -                        test foo comment -                                                                                                                                                                      
~ 127.0.0.4          22                  ovh                     foo(group)  poweruser    2020-10-26                                             -                                        - -                                                                                                                                                                      
~ 4 accesses listed

When I add another user as a guest of my foo group, user can't see the userComment that has been set by the person who add the server.

user@zbst-rbeuque(master)> selfListAccesses
---zbst-rbeuque--------------------------------the-bastion-2.99.99-rc9.4-ovh1---
=> your access list
--------------------------------------------------------------------------------
~ Dear robot-framework, you have access to the following servers:
~ IP               PORT                 USER                      ACCESS-BY   ADDED-BY      ADDED-AT                                       EXPIRY?                                  COMMENT FORCED-KEY?                                                                                                                                                            
~ 127.0.0.1          22                  ovh               foo(group-guest)  poweruser    2020-10-26                                             -                                        - -                                                                                                                                                                      
~ 127.0.0.4          22                  ovh               foo(group-guest)  poweruser    2020-10-26                                             -                                        - -                                                                                                                                                                      
~ 3 accesses listed
----------------------------------------------------------</selfListAccesses>---

I guess the issue is around:

groupSetRole calls OVH::Bastion::is_access_way_granted then osh-accountAddGroupServer.
OVH::Bastion::is_access_way_granted retrieve the current ACL, which contains the comment, but doesn't retrieve it completely, and more specifically, doesn't forward it to osh-accountAddGroupServer
This comment could be used as a parameter in osh-accountAddGroupServer while calling OVH::Bastion::access_modify.

Originally created by @rbeuque74 on GitHub (Oct 26, 2020). Original GitHub issue: https://github.com/ovh/the-bastion/issues/17 I have a group, with 4 servers, some of them have `userComment` on it: ``` poweruser@zbst-rbeuque(master)> groupListServers --group foo ---zbst-rbeuque--------------------------------the-bastion-2.99.99-rc9.4-ovh1--- => list of servers pertaining to the group -------------------------------------------------------------------------------- ~ IP PORT USER ACCESS-BY ADDED-BY ADDED-AT EXPIRY? COMMENT FORCED-KEY? ~ 127.0.0.1 22 ovh foo(group) poweruser 2020-10-26 - - - ~ 127.0.0.2 22 ovh foo(group) poweruser 2020-10-26 - test comment - ~ 127.0.0.3 22 ovh foo(group) poweruser 2020-10-26 - test foo comment - ~ 127.0.0.4 22 ovh foo(group) poweruser 2020-10-26 - - - ~ 4 accesses listed ``` When I add another user as a guest of my `foo` group, user can't see the `userComment` that has been set by the person who add the server. ``` user@zbst-rbeuque(master)> selfListAccesses ---zbst-rbeuque--------------------------------the-bastion-2.99.99-rc9.4-ovh1--- => your access list -------------------------------------------------------------------------------- ~ Dear robot-framework, you have access to the following servers: ~ IP PORT USER ACCESS-BY ADDED-BY ADDED-AT EXPIRY? COMMENT FORCED-KEY? ~ 127.0.0.1 22 ovh foo(group-guest) poweruser 2020-10-26 - - - ~ 127.0.0.4 22 ovh foo(group-guest) poweruser 2020-10-26 - - - ~ 3 accesses listed ----------------------------------------------------------</selfListAccesses>--- ``` I guess the issue is around: - https://github.com/ovh/the-bastion/blob/master/bin/helper/osh-accountAddGroupServer#L72 - https://github.com/ovh/the-bastion/blob/master/lib/perl/OVH/Bastion/Plugin/groupSetRole.pm#L191 - https://github.com/ovh/the-bastion/blob/master/lib/perl/OVH/Bastion/allowkeeper.inc#L235 `groupSetRole` calls `OVH::Bastion::is_access_way_granted` then `osh-accountAddGroupServer`. `OVH::Bastion::is_access_way_granted` retrieve the current ACL, which contains the comment, but doesn't retrieve it completely, and more specifically, doesn't forward it to `osh-accountAddGroupServer` This comment could be used as a parameter in `osh-accountAddGroupServer` while calling `OVH::Bastion::access_modify`.