118 lines
2.8 KiB
Markdown
118 lines
2.8 KiB
Markdown
# Calypso User Permissions Setup
|
|
**Tanggal:** 2025-01-09
|
|
**User:** `calypso`
|
|
**Status:** ✅ **CONFIGURED**
|
|
|
|
## Problem
|
|
|
|
User `calypso` tidak memiliki permission yang cukup untuk:
|
|
- Mengakses raw disk devices (`/dev/sd*`)
|
|
- Menjalankan ZFS commands (`zpool`, `zfs`)
|
|
- Mengakses tape devices
|
|
- Menjalankan SCST commands
|
|
|
|
## Solution
|
|
|
|
### 1. Group Membership
|
|
|
|
User `calypso` telah ditambahkan ke groups berikut:
|
|
- `disk` - Access to disk devices
|
|
- `tape` - Access to tape devices
|
|
- `storage` - Storage-related permissions
|
|
|
|
```bash
|
|
sudo usermod -aG disk,tape,storage calypso
|
|
```
|
|
|
|
### 2. Sudoers Configuration
|
|
|
|
File `/etc/sudoers.d/calypso` telah dibuat dengan permissions berikut:
|
|
|
|
#### ZFS Commands
|
|
```sudoers
|
|
calypso ALL=(ALL) NOPASSWD: /usr/sbin/zpool, /usr/sbin/zfs, /usr/bin/zpool, /usr/bin/zfs
|
|
```
|
|
|
|
#### SCST Commands
|
|
```sudoers
|
|
calypso ALL=(ALL) NOPASSWD: /usr/sbin/scstadmin, /usr/bin/scstadmin
|
|
```
|
|
|
|
#### Tape Utilities
|
|
```sudoers
|
|
calypso ALL=(ALL) NOPASSWD: /usr/bin/mtx, /usr/bin/mt, /usr/bin/sg_*, /usr/bin/sg3_utils/*
|
|
```
|
|
|
|
#### System Monitoring
|
|
```sudoers
|
|
calypso ALL=(ALL) NOPASSWD: /usr/bin/systemctl status *, /usr/bin/systemctl is-active *, /usr/bin/journalctl -u *
|
|
```
|
|
|
|
## Verification
|
|
|
|
### Check Group Membership
|
|
```bash
|
|
groups calypso
|
|
# Output should include: disk tape storage
|
|
```
|
|
|
|
### Check Sudoers File
|
|
```bash
|
|
sudo visudo -c -f /etc/sudoers.d/calypso
|
|
# Should return: /etc/sudoers.d/calypso: parsed OK
|
|
```
|
|
|
|
### Test ZFS Access
|
|
```bash
|
|
sudo -u calypso zpool list
|
|
# Should work without errors
|
|
```
|
|
|
|
### Test Device Access
|
|
```bash
|
|
sudo -u calypso ls -la /dev/sdb
|
|
# Should show device permissions
|
|
```
|
|
|
|
## Backend Code Changes Needed
|
|
|
|
Backend code perlu menggunakan `sudo` untuk ZFS commands. Contoh:
|
|
|
|
```go
|
|
// Before (will fail with permission denied)
|
|
cmd := exec.CommandContext(ctx, "zpool", "create", ...)
|
|
|
|
// After (with sudo)
|
|
cmd := exec.CommandContext(ctx, "sudo", "zpool", "create", ...)
|
|
```
|
|
|
|
## Current Status
|
|
|
|
✅ **Groups:** User calypso added to disk, tape, storage groups
|
|
✅ **Sudoers:** Configuration file created and validated
|
|
✅ **Permissions:** File permissions set to 0440 (secure)
|
|
⏭️ **Code Update:** Backend code needs to use `sudo` for privileged commands
|
|
|
|
## Next Steps
|
|
|
|
1. ✅ Groups configured
|
|
2. ✅ Sudoers configured
|
|
3. ⏭️ Update backend code to use `sudo` for:
|
|
- ZFS operations (`zpool`, `zfs`)
|
|
- SCST operations (`scstadmin`)
|
|
- Tape operations (`mtx`, `mt`, `sg_*`)
|
|
4. ⏭️ Restart Calypso API service
|
|
5. ⏭️ Test ZFS pool creation via frontend
|
|
|
|
## Important Notes
|
|
|
|
- Sudoers file uses `NOPASSWD` for convenience (service account)
|
|
- Only specific commands are allowed (security best practice)
|
|
- File permissions are 0440 (read-only for root and group)
|
|
- Service restart required after permission changes
|
|
|
|
---
|
|
|
|
**Status:** ✅ **PERMISSIONS CONFIGURED**
|
|
**Action Required:** Update backend code to use `sudo` for privileged commands
|