[GH-ISSUE #329] Expired (TTL-wise) accounts do expire but it's not shown on accountInfo #83

New issue

Closed

opened 2026-05-07 00:18:33 +02:00 by BreizhHardware · 2 comments

BreizhHardware commented

2026-05-07 00:18:33 +02:00

Owner

Originally created by @speed47 on GitHub (Jul 15, 2022).
Original GitHub issue: https://github.com/ovh/the-bastion/issues/329

see https://github.com/ovh/the-bastion/issues/313#issuecomment-1184158231

Originally created by @speed47 on GitHub (Jul 15, 2022). Original GitHub issue: https://github.com/ovh/the-bastion/issues/329 see https://github.com/ovh/the-bastion/issues/313#issuecomment-1184158231

BreizhHardware

2026-05-07 00:18:33 +02:00

closed this issue
added the
bug
label

BreizhHardware commented

2026-05-07 00:18:34 +02:00

Author

Owner

@speed47 commented on GitHub (Jul 15, 2022):

slesimpl@dev(master)> adminSudo -- --sudo-as expi30sec --sudo-cmd info
╭──ac777d06bec9───────────────────────────────────────the-bastion-3.09.00-rc3───
│ ▶ launching a bastion command or connection, impersonating another user
├───────────────────────────────────────────────────────────────────────────────
│ ❗ ADMIN SUDO: slesimpl, you'll now impersonate expi30sec, this has been logged.
│ 
│ ⛔ Sorry expi30sec, your account has expired.
│ Command exited with status 121
╰────────────────────────────────────────────────────────────────</adminSudo>───
slesimpl@dev(master)> accountInfo --account expi30sec
╭──ac777d06bec9───────────────────────────────────────the-bastion-3.09.00-rc3───
│ ▶ account information
├───────────────────────────────────────────────────────────────────────────────
│ This account has access to the following restricted commands:
│ (none)
│ 
│ This account is active
│ This account is not expired
│ As a consequence, this account can connect to this bastion

The terminology here can be confusing, we need to change that.
In the context of accountInfo:

active is whether this account has been declared active or inactive by an external system, if such policy is enabled (see https://ovh.github.io/the-bastion/administration/configuration/bastion_conf.html#accountexternalvalidationprogram)
expired is whether this account has logged-in recently enough to not be auto-expired, if such policy is enabled (https://ovh.github.io/the-bastion/administration/configuration/bastion_conf.html#accountmaxinactivedays)
The TTL status is not shown here, it should be. This also means that the sentence this account can connect to this bastion is incorrect in this case, as the TTL has expired, and in effect the account can not connect.

@speed47 commented on GitHub (Jul 15, 2022): ``` slesimpl@dev(master)> adminSudo -- --sudo-as expi30sec --sudo-cmd info ╭──ac777d06bec9───────────────────────────────────────the-bastion-3.09.00-rc3─── │ ▶ launching a bastion command or connection, impersonating another user ├─────────────────────────────────────────────────────────────────────────────── │ ❗ ADMIN SUDO: slesimpl, you'll now impersonate expi30sec, this has been logged. │ │ ⛔ Sorry expi30sec, your account has expired. │ Command exited with status 121 ╰────────────────────────────────────────────────────────────────</adminSudo>─── slesimpl@dev(master)> accountInfo --account expi30sec ╭──ac777d06bec9───────────────────────────────────────the-bastion-3.09.00-rc3─── │ ▶ account information ├─────────────────────────────────────────────────────────────────────────────── │ This account has access to the following restricted commands: │ (none) │ │ This account is active │ This account is not expired │ As a consequence, this account can connect to this bastion ``` The terminology here can be confusing, we need to change that. In the context of `accountInfo`: - `active` is whether this account has been declared active or inactive by an external system, if such policy is enabled (see https://ovh.github.io/the-bastion/administration/configuration/bastion_conf.html#accountexternalvalidationprogram) - `expired` is whether this account has logged-in recently enough to not be auto-expired, if such policy is enabled (https://ovh.github.io/the-bastion/administration/configuration/bastion_conf.html#accountmaxinactivedays) - The TTL status is not shown here, it should be. This also means that the sentence `this account can connect to this bastion` is incorrect in this case, as the TTL has expired, and in effect the account can not connect.

BreizhHardware commented

2026-05-07 00:18:34 +02:00

Author

Owner

@speed47 commented on GitHub (Sep 21, 2022):

Merged and released in v3.09.00

@speed47 commented on GitHub (Sep 21, 2022): Merged and released in v3.09.00

BreizhHardware referenced this issue

2026-05-07 00:19:52 +02:00

[PR #83] [MERGED] fix: packages-check: centos8: handle new repo names #220