Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

highlight the ability to disable users #893

Merged
merged 1 commit into from
Dec 1, 2023
Merged

highlight the ability to disable users #893

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions source/customizations.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -364,6 +364,8 @@ We recommend setting this environment variable in ``/etc/ood/config/nginx_stage.

.. warning:: This allowlist is not enforced across every action a user can take in an app (including the developer views in the Dashboard). Also, it is enforced via the apps themselves, which is not as robust as using cgroups on the PUN.

.. include:: customizations/disabling-users.inc

.. _set-default-ssh-host:

Set Default SSH Host
Expand Down
10 changes: 10 additions & 0 deletions source/customizations/disabling-users.inc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
.. _disabling-users-guide:

Disabling Users
---------------

You can use the :ref:`nginx stage configuration for disabling users <disabled_shell>`
to disable access to specific users based on the users' default ``shell``.

For example you could disable access to Open OnDemand for any user with the ``/usr/bin/false``
default shell.
17 changes: 13 additions & 4 deletions source/reference/files/nginx-stage-yml.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -776,17 +776,26 @@ Configuration Options

For RHEL6 and CentOS 6 the user id's begin at ``500``.

.. _disabled_shell:

.. describe:: disabled_shell (String)

restrict starting a per-user NGINX process as a user with the given shell
Restrict starting a per-user NGINX process as a user with the given shell.

Default
For OSC restrictions
Default
Do not start a per-user NGINX for anyone with ``/access/denied`` shell.

.. code-block:: yaml
.. code-block:: yaml

disabled_shell: "/access/denied"

Example
Do not start a per-user NGINX for anyone with ``/usr/bin/false`` shell.

.. code-block:: yaml

disabeled_shell: "/usr/bin/false"

.. note::

This will only restrict access to a per-user NGINX process started with
Expand Down