HLD for persistent local user management by manoharan-nexthop · Pull Request #2018 · sonic-net/SONiC

manoharan-nexthop · 2025-06-17T02:38:06Z

Currently the local users that are created are not persistent across upgrades. This HLD proposes to manage the users across upgrades by storing the configuration in CONFIG_DB and a daemon to manage them in Linux.

Implementation Pull requests:

mssonicbld · 2025-06-17T02:38:13Z

/azp run

azure-pipelines · 2025-06-17T02:38:19Z

No pipelines are associated with this pull request.

mssonicbld · 2025-06-18T14:20:37Z

/azp run

azure-pipelines · 2025-06-18T14:20:44Z

No pipelines are associated with this pull request.

mssonicbld · 2025-06-19T08:16:36Z

/azp run

azure-pipelines · 2025-06-19T08:16:42Z

No pipelines are associated with this pull request.

mssonicbld · 2025-06-19T08:21:30Z

/azp run

azure-pipelines · 2025-06-19T08:21:35Z

No pipelines are associated with this pull request.

mssonicbld · 2025-06-26T05:45:44Z

/azp run

azure-pipelines · 2025-06-26T05:45:50Z

No pipelines are associated with this pull request.

mssonicbld · 2025-07-01T14:40:28Z

/azp run

azure-pipelines · 2025-07-01T14:40:34Z

No pipelines are associated with this pull request.

mssonicbld · 2025-07-01T14:45:52Z

/azp run

azure-pipelines · 2025-07-01T14:45:58Z

No pipelines are associated with this pull request.

mssonicbld · 2025-07-01T14:48:44Z

/azp run

azure-pipelines · 2025-07-01T14:48:50Z

No pipelines are associated with this pull request.

mssonicbld · 2025-07-01T14:49:59Z

/azp run

anders-nexthop · 2025-09-17T18:01:23Z

@manoharan-nexthop - Do you have some draft implementation or just HLD changes? If you have any specific details or examples, please share them.

@vitaliibylinka PRs with implementation details have been posted.

mssonicbld · 2025-09-18T04:19:43Z

/azp run

azure-pipelines · 2025-09-18T04:19:49Z

No pipelines are associated with this pull request.

spandan-nexthop

LGTM!
Just added some comments/questions.

arlakshm · 2025-10-08T15:09:16Z

@qiluo-msft can you please help signoff on this feature?

This implementation addresses the User Management HLD requirements for centralized user administration in SONiC. sonic-net/SONiC#2018 nexthop-ai/private-sonic-host-services#54 nexthop-ai/private-sonic-utilities#120 **1. YANG Model & Configuration Schema:** - Added sonic-user.yang model defining LOCAL_USER and LOCAL_ROLE_SECURITY_POLICY tables - Integrated user management into CONFIG_DB schema with role-based configuration - Added DEVICE_METADATA.local_user_management feature flag **2. User Management Daemon (userd):** - Implemented C++ daemon using SWSS framework for CONFIG_DB integration - Added user lifecycle management (create/update/delete/enable/disable) - Implemented role-based group assignment (administrator, operator roles) - Added SSH key management with proper file permissions - Integrated PAM faillock configuration using Jinja2 templates **3. CLI Interface:** - Extended sonic-utilities with 'config user' and 'show user' commands - Added user import functionality to migrate existing system users - Added role-based user management with proper validation **4. Build System Integration:** - Added sonic-host-services package with userd daemon and systemd service - Integrated user management into SONiC image build process - Added template-based configuration generation for init_cfg.json - Added build dependencies for JSON processing and password hashing Tested for all the features that are implemented.

mssonicbld · 2025-11-25T10:22:18Z

/azp run

azure-pipelines · 2025-11-25T10:22:24Z

No pipelines are associated with this pull request.

mssonicbld · 2025-11-25T15:31:37Z

/azp run

azure-pipelines · 2025-11-25T15:31:44Z

No pipelines are associated with this pull request.

BYGX-wcr · 2025-12-16T23:25:51Z

Password hashes are also considered sensitive data since they can be used for reverse-engineering to get the password. Normally, /etc/shadow is only readable to root-level user. Making this change in SONiC essentially expose the /etc/shadow file content to general users and breaks the security policy of Linux.

aidan-gallagher · 2025-12-17T11:14:03Z

Password hashes are also considered sensitive data since they can be used for reverse-engineering to get the password. Normally, /etc/shadow is only readable to root-level user. Making this change in SONiC essentially expose the /etc/shadow file content to general users and breaks the security policy of Linux.

I believe the CLI show command will only show password hashes when the user is root.
See can_view_passwords in https://github.com/sonic-net/sonic-utilities/pull/4053/files#diff-3311722931fe6ac91c84f68dc5b09d27dbc6624d78e59165e1f0c54564a5b947R29.

I believe the file /etc/sonic/config_db.json is currently world readable

-rw-r--r-- 1 root root 17K Sep 23 09:07 /etc/sonic/config_db.json

And it will need to be changed to this

-rw--r---- 1 root redis 731 Sep 16 14:25 /etc/sonic/config_db.json

I don't see the code to do that in this PR? I would expect something like the following code at the end of generate_config() (
https://github.com/sonic-net/sonic-buildimage/blob/master/files/image_config/config-setup/config-setup#L255)

sudo chmod 640 ${DEST_FILE}
sudo chown root:redis ${DEST_FILE}

This implementation addresses the User Management HLD requirements for centralized user administration in SONiC. sonic-net/SONiC#2018 nexthop-ai/private-sonic-host-services#54 nexthop-ai/private-sonic-utilities#120 **1. YANG Model & Configuration Schema:** - Added sonic-user.yang model defining LOCAL_USER and LOCAL_ROLE_SECURITY_POLICY tables - Integrated user management into CONFIG_DB schema with role-based configuration - Added DEVICE_METADATA.local_user_management feature flag **2. User Management Daemon (userd):** - Implemented Rust daemon using SWSS framework for CONFIG_DB integration - Added user lifecycle management (create/update/delete/enable/disable) - Implemented role-based group assignment (administrator, operator roles) - Added SSH key management with proper file permissions - Integrated PAM faillock configuration using Jinja2 templates **3. CLI Interface:** - Extended sonic-utilities with 'config user' and 'show user' commands - Added user import functionality to migrate existing system users - Added role-based user management with proper validation **4. Build System Integration:** - Added template-based configuration generation for init_cfg.json - Added build dependencies for JSON processing and password hashing Tested for all the features that are implemented.

This implementation addresses the User Management HLD requirements for centralized user administration in SONiC. sonic-net/SONiC#2018 nexthop-ai/private-sonic-host-services#54 nexthop-ai/private-sonic-utilities#120 **1. YANG Model & Configuration Schema:** - Added sonic-user.yang model defining LOCAL_USER and LOCAL_ROLE_SECURITY_POLICY tables - Integrated user management into CONFIG_DB schema with role-based configuration - Added DEVICE_METADATA.local_user_management feature flag **2. User Management Daemon (userd):** - Implemented Rust daemon using SWSS framework for CONFIG_DB integration - Added user lifecycle management (create/update/delete/enable/disable) - Implemented role-based group assignment (administrator, operator roles) - Added SSH key management with proper file permissions - Integrated PAM faillock configuration using Jinja2 templates **3. CLI Interface:** - Extended sonic-utilities with 'config user' and 'show user' commands - Added user import functionality to migrate existing system users - Added role-based user management with proper validation **4. Build System Integration:** - Added template-based configuration generation for init_cfg.json - Added build dependencies for JSON processing and password hashing Tested for all the features that are implemented. Signed-off-by: Manoharan Sundaramoorthy <manoharan@nexthop.ai>

rookie-who · 2026-05-19T04:03:12Z

Hi @manoharan-nexthop — the 202605 branch cut is at end of May. This PR has had no activity since Dec 2025. Are you still planning to land this for 202605? If so, please address @aidan-gallagher's review comments. Otherwise we may need to defer to the next release.

CC: @vaibhavhd @radha-danda (branch managers)

anders-nexthop · 2026-05-19T04:56:02Z

Hi @manoharan-nexthop — the 202605 branch cut is at end of May. This PR has had no activity since Dec 2025. Are you still planning to land this for 202605? If so, please address @aidan-gallagher's review comments. Otherwise we may need to defer to the next release.

CC: @vaibhavhd @radha-danda (branch managers)

@rookie-who there is recent activity on all of the linked PRs, including LGTM responses on all three from @aidan-gallagher. These PRs still require sign-off from a reviewer with write-access before they can be merged.

rookie-who · 2026-05-19T06:00:30Z

Hi @qiluo-msft @maipbui — could you please review and sign off on this HLD from the AAA and user management perspective? The 202605 branch cut is at end of May.

CC: @vaibhavhd @radha-danda (branch managers)

securely1g · 2026-05-19T06:00:30Z

@qiluo-msft @maipbui Could you review and sign off on this HLD from the AAA and user management perspective? Thanks!

This implementation addresses the User Management HLD requirements for centralized user administration in SONiC. sonic-net/SONiC#2018 nexthop-ai/private-sonic-host-services#54 nexthop-ai/private-sonic-utilities#120 **1. YANG Model & Configuration Schema:** - Added sonic-user.yang model defining LOCAL_USER and LOCAL_ROLE_SECURITY_POLICY tables - Integrated user management into CONFIG_DB schema with role-based configuration - Added DEVICE_METADATA.local_user_management feature flag **2. User Management Daemon (userd):** - Implemented Rust daemon using SWSS framework for CONFIG_DB integration - Added user lifecycle management (create/update/delete/enable/disable) - Implemented role-based group assignment (administrator, operator roles) - Added SSH key management with proper file permissions - Integrated PAM faillock configuration using Jinja2 templates **3. CLI Interface:** - Extended sonic-utilities with 'config user' and 'show user' commands - Added user import functionality to migrate existing system users - Added role-based user management with proper validation **4. Build System Integration:** - Added template-based configuration generation for init_cfg.json - Added build dependencies for JSON processing and password hashing Tested for all the features that are implemented. Signed-off-by: Manoharan Sundaramoorthy <manoharan@nexthop.ai>

rookie-who · 2026-06-02T23:46:44Z

This PR/feature will not be included in the SONiC 202605 release. It can be retargeted for the 202611 release.

manoharan-nexthop force-pushed the user-mgmt branch from bc68d29 to 62d56bc Compare June 18, 2025 14:20

manoharan-nexthop force-pushed the user-mgmt branch from 62d56bc to fd6aea7 Compare June 19, 2025 08:16

manoharan-nexthop force-pushed the user-mgmt branch from fd6aea7 to 7c4b7d3 Compare June 19, 2025 08:21

manoharan-nexthop force-pushed the user-mgmt branch from 7c4b7d3 to 3c56ccb Compare June 26, 2025 05:45

anilpannala added this to SONiC 202511 Release Jun 30, 2025

anilpannala assigned manoharan-nexthop Jun 30, 2025

anilpannala moved this to 📋 In Plan Features in SONiC 202511 Release Jun 30, 2025

bluecmd reviewed Jul 1, 2025

View reviewed changes

Comment thread doc/User_Management/User_Management.md

bluecmd reviewed Jul 1, 2025

View reviewed changes

Comment thread doc/User_Management/User_Management.md Outdated

manoharan-nexthop force-pushed the user-mgmt branch from 3c56ccb to db52f3b Compare July 1, 2025 14:40

manoharan-nexthop force-pushed the user-mgmt branch from db52f3b to 6653490 Compare July 1, 2025 14:45

manoharan-nexthop force-pushed the user-mgmt branch from 6653490 to 793f412 Compare July 1, 2025 14:48

manoharan-nexthop force-pushed the user-mgmt branch from 793f412 to bf17e02 Compare July 1, 2025 14:49

manoharan-nexthop force-pushed the user-mgmt branch from 4a02cf2 to fe06f5f Compare September 18, 2025 04:19

spandan-nexthop reviewed Sep 23, 2025

View reviewed changes

Comment thread doc/User_Management/User_Management.md Outdated

Comment thread doc/User_Management/User_Management.md

Comment thread doc/User_Management/User_Management.md

manoharan-nexthop force-pushed the user-mgmt branch from fe06f5f to cb6b0d2 Compare November 25, 2025 10:22

HLD for persistent local user management

c1032c8

manoharan-nexthop force-pushed the user-mgmt branch from cb6b0d2 to c1032c8 Compare November 25, 2025 15:31

venkatmahalingam reviewed Nov 26, 2025

View reviewed changes

Comment thread doc/User_Management/User_Management.md

BYGX-wcr reviewed Dec 16, 2025

View reviewed changes

Comment thread doc/User_Management/User_Management.md

anilpannala moved this from 🏗 In Progress to 🆕 Backlog (not in plan yet) in SONiC 202511 Release Feb 6, 2026

zhangyanzhao added this to SONiC 202605 Release Feb 12, 2026

github-project-automation Bot moved this to Todo in SONiC 202605 Release Feb 12, 2026

zhangyanzhao moved this from Todo to In Progress in SONiC 202605 Release Feb 12, 2026

Uh oh!

Conversation

manoharan-nexthop commented Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mssonicbld commented Jun 17, 2025

Uh oh!

azure-pipelines Bot commented Jun 17, 2025

Uh oh!

mssonicbld commented Jun 18, 2025

Uh oh!

azure-pipelines Bot commented Jun 18, 2025

Uh oh!

mssonicbld commented Jun 19, 2025

Uh oh!

azure-pipelines Bot commented Jun 19, 2025

Uh oh!

mssonicbld commented Jun 19, 2025

Uh oh!

azure-pipelines Bot commented Jun 19, 2025

Uh oh!

mssonicbld commented Jun 26, 2025

Uh oh!

azure-pipelines Bot commented Jun 26, 2025

Uh oh!

Uh oh!

Uh oh!

mssonicbld commented Jul 1, 2025

Uh oh!

azure-pipelines Bot commented Jul 1, 2025

Uh oh!

mssonicbld commented Jul 1, 2025

Uh oh!

azure-pipelines Bot commented Jul 1, 2025

Uh oh!

mssonicbld commented Jul 1, 2025

Uh oh!

azure-pipelines Bot commented Jul 1, 2025

Uh oh!

mssonicbld commented Jul 1, 2025

Uh oh!

anders-nexthop commented Sep 17, 2025

Uh oh!

mssonicbld commented Sep 18, 2025

Uh oh!

azure-pipelines Bot commented Sep 18, 2025

Uh oh!

spandan-nexthop left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

arlakshm commented Oct 8, 2025

Uh oh!

mssonicbld commented Nov 25, 2025

Uh oh!

azure-pipelines Bot commented Nov 25, 2025

Uh oh!

mssonicbld commented Nov 25, 2025

Uh oh!

azure-pipelines Bot commented Nov 25, 2025

Uh oh!

Uh oh!

BYGX-wcr commented Dec 16, 2025

Uh oh!

Uh oh!

aidan-gallagher commented Dec 17, 2025

Uh oh!

rookie-who commented May 19, 2026

Uh oh!

anders-nexthop commented May 19, 2026

Uh oh!

rookie-who commented May 19, 2026

Uh oh!

securely1g commented May 19, 2026

Uh oh!

rookie-who commented Jun 2, 2026

Uh oh!

Reviewers

manoharan-nexthop commented Jun 17, 2025 •

edited

Loading