Bug: Adding a user to a group in the UI no longer adds them to the unix group

[davidolrik]

Hi,

I have just discovered a small bug regarding user group membership:

When editing a user in the UI, adding or removing a user from a group no longer updates the unix group membership.

Bug seen on OPNsense 25.1.4_1-amd64

--
Best regards,
David Jack Wange Olrik

[patient0]

It is possible that you encounter the following:

OPNsense 25.1 released

o The access management was rewritten in MVC and contains behavioural changes including not rendering UNIX accounts for non-shell users. [...]

[davidolrik]

It is possible that you encounter the following:

OPNsense 25.1 released

I don't think so, I have 4 installations with OPNsense 25.1.4_1-amd64 and only one of them is exhibiting the problem.

All of the users are non-admin accounts with a shell configured so they can be used as a jump host.

The UI renders fine, but adding or removing group membership has no effect.

As a workaround, I've just added the user to the unix group manually like so `sudo pw group mod ssh -m <username>`

[Patrick M. Hausen]

As a workaround, I've just added the user to the unix group manually like so `sudo pw group mod ssh -m <username>`

That won't survive a reboot, IIRC.

[davidolrik]

That won't survive a reboot, IIRC.

It does indeed survive a reboot.

[Patrick M. Hausen]

That won't survive a reboot, IIRC.

It does indeed survive a reboot.

Interesting, thanks. What about doing any modification on users and/or groups in the UI and clicking "save"?

[davidolrik]

Interesting, thanks. What about doing any modification on users and/or groups in the UI and clicking "save"?

That the problem I'm experiencing, using the UI does nothing for the unix groups. I've tried editing both individual fields and the group selector.
State change is remembered in the UI but not reflected in the unix groups.

And I just found out, that while manual change using sudo pw group mod ssh -m <username> does survive a reboot - it does not survive an upgrade to 25.1.7_2

I've played around a bit more, and I have found that group removal is reflected in the unix groups, but not adding user to group (tested on an admin user).

[Patrick M. Hausen]

OPNsense does not use the Unix groups. It comes with its own PAM module:

https://github.com/opnsense/ports/tree/master/opnsense/pam

[davidolrik]

OPNsense does not use the Unix groups. It comes with its own PAM module:

https://github.com/opnsense/ports/tree/master/opnsense/pam

Well ssh still does, and OPNsense used to keep group membership in sync which allowed me to create a special group called ssh and put all users that need ssh access in that group (even users with /usr/sbin/nologin set as shell).

This no longer works, now only admins get to have ssh access through the wheel group.

I use OPNsense as a jumphost, and setting an additional group in "System->Settings->Administration->Secure shell->Login group" no longer has any effect for any user.

[davidolrik]

I think this is a regression in functionality, and have created an issue on GitHub:

https://github.com/opnsense/core/issues/8721