Vyatta offers a role-based access control (RBAC) feature with the acm syntax as a method of restricting access to the configuration for authorized users. Users may learn more about the particulars of RBAC by reviewing the Basic System Configuration guide.

Enhancements to the firewall feature in 1912 require certain acm rules to be present in the configuration to allow operator level users to view the output of the show firewall command. Customers upgrading from prior Vyatta versions to 1912 and later may be lacking these rules when their configurations are merged during the upgrade process.

To allow operators to display output in the show firewall command, the configuration in "Additional ruleset" must be present in the configuration and the system must be running a version of the OS that contains the VRVDR-54360 fix (1912k or later releases). VRVDR-54360 Operator level user cannot execute 'showd firewall ...' commands is a cosmetic display issue and does not affect the traffic forwarding.

In addition to the show firewall command, this change affected the following additional commands and also require the "Additional Ruleset" for operators to execute the commands successfully:

show nat
clear block-device all unused-blocks
clear block-device sda unused-blocks
show system storage block-device
clear bmc sel
show interfaces dataplane <interface> affinity
show interfaces dataplane <interface> identify
show interfaces dataplane <interface> physical
reset system tacplus suppression-timers
reset system login users account-disabled <user>
clear security ip-packet-filter statistics ...
show security ip-packet-filter statistics ...

Add the following acm rules to the configuration of customers upgrading to 1912k to allow operator-level users to utilize the commands above:

set system acm rpc-ruleset rule 9981 action allow
set system acm rpc-ruleset rule 9981 group vyattaop
set system acm rpc-ruleset rule 9981 rpc-name 'vyatta-system-tacplus-v1:reset-suppression-timers'
set system acm rpc-ruleset rule 9982 action allow
set system acm rpc-ruleset rule 9982 group vyattaop
set system acm rpc-ruleset rule 9982 rpc-name 'vyatta-system-bmc-v1:clear-bmc-sel'
set system acm rpc-ruleset rule 9983 action allow
set system acm rpc-ruleset rule 9983 group vyattaop
set system acm rpc-ruleset rule 9983 rpc-name 'vyatta-interfaces-dataplane-transceiver-v1:xcvr-info'
set system acm rpc-ruleset rule 9984 action allow
set system acm rpc-ruleset rule 9984 group vyattaop
set system acm rpc-ruleset rule 9984 rpc-name 'vyatta-interfaces-dataplane-ethernet-info-v1:eth-info'
set system acm rpc-ruleset rule 9985 action allow
set system acm rpc-ruleset rule 9985 group vyattaop
set system acm rpc-ruleset rule 9985 rpc-name 'vyatta-interfaces-dataplane-rpc-v1:slowpath-info'
set system acm rpc-ruleset rule 9986 action allow
set system acm rpc-ruleset rule 9986 group vyattaop
set system acm rpc-ruleset rule 9986 rpc-name 'vyatta-interfaces-dataplane-rpc-v1:identify-info'
set system acm rpc-ruleset rule 9987 action allow
set system acm rpc-ruleset rule 9987 group vyattaop
set system acm rpc-ruleset rule 9987 rpc-name 'vyatta-interfaces-dataplane-rpc-v1:affinity-info'
set system acm rpc-ruleset rule 9988 action allow
set system acm rpc-ruleset rule 9988 group vyattaop
set system acm rpc-ruleset rule 9988 rpc-name 'vyatta-system-storage-v1:clear-block-device-unused-blocks'
set system acm rpc-ruleset rule 9989 action allow
set system acm rpc-ruleset rule 9989 group vyattaop
set system acm rpc-ruleset rule 9989 rpc-name 'vyatta-system-storage-v1:get-block-device'
set system acm rpc-ruleset rule 9990 action allow
set system acm rpc-ruleset rule 9990 group vyattaop
set system acm rpc-ruleset rule 9990 rpc-name 'vyatta-cpp-rate-limiter-v1:clear-statistics'
set system acm rpc-ruleset rule 9991 action allow
set system acm rpc-ruleset rule 9991 group vyattaop
set system acm rpc-ruleset rule 9991 rpc-name 'vyatta-ippf-v1:clear-statistics'
set system acm rpc-ruleset rule 9992 action allow
set system acm rpc-ruleset rule 9992 group vyattaop
set system acm rpc-ruleset rule 9992 rpc-name 'vyatta-ippf-v1:get-statistics'

Note that the acm rpc-ruleset rules are in the default config.boot in release 2012 and later. In earlier releases, add the commands by following the above instructions. Similarly, add the commands with these instructions if an image upgrade to 2012 or newer is performed, and the user chooses to retain the configuration of the image being upgraded.

A user can determine their current login level by executing the show login command:

$ show login
login   : oper
level   : Operator
user    : oper
groups  :  users systemd-journal vyattaop wireshark 

$ show firewall 
Error: no response from dataplane

$ show nat 
Error: no response from dataplane

Customers on a patch prior to 1912k can circumvent this issue by changing the privilege level of the user account from operator to admin:

$ configure
# set system login user alice level admin 
# commit
# exit
$ exit

User isolation provides a secure sandbox for users so that they have limited access to the host systems.

Vyatta administrators and operators have the convenience of running a normal bash shell. But, this also allows the user to access much of the systems information which may be exploited if the user's login gets compromised. The user isolation feature retains the convenience of the bash login shell and the ability to run many of the utility commands but restricts the user to a secure sandbox that limits access to most of the host system.

User isolation allows the user to run the modeled commands as permitted by the configured ACM rules but limits the unmodeled commands to a minimal set and minimizes their impact outside of the users sandbox.

Utility commands are only filters for other commands, for example match, grep, awk, sed, more, less, script interpreters, which are either shell built-ins or individual executables.

Unmodeled commands are commands that are not officially modeled via the Vyatta operational command interface or configuration command interface. The following are examples of unmodeled commands:

• Script interpreters/shells calling unmodeled commands
• Low-level Linux commands inside the PATH or called with relative/absolute path
• Aliases calling unmodeled commands

In releases 1903 and later, user isolation is enabled by default. This choice was made to provide a secure default for new installations. Customers upgrading from releases prior to 1903, to release 1903 or later, will have user isolation enabled after the upgrade.

To disable the user isolation feature, the command set system login user-isolation disable may be added to the configuration. If this configuration is not present, user isolation will be enabled. Once user isolation is disabled, the user must log out, then log back into the system to experience the new environment.

vbash-sandbox <command>: command not found

$ ls /usr/bin | grep grep
egrep
fgrep
grep
pgrep
ptargrep
rgrep
zegrep
zfgrep
zgrep

The user isolation feature comes with certain limitations when dealing with user account levels and diagnostic collection.