fix: the shell runs as the console account of each member of admins, a local account or the user's own POSIX account in the directory, which also signs in with SSH and sudo, instead of one web.shell_user.

debian-package/src/usr/lib/vpn-router/web

@@ -34,7 +34,8 @@ Pages:
   /pki/<name>.crt, /pki/<name>.crl
            the DER certificate and CRL of the root (root) and of each issuing CA, which the
            certificates name in their AIA and CRL distribution points; no authentication
-  /shell   while web.shell is true, a login shell of web.shell_user on a terminal: POST signs the
+  /shell   while web.shell is true, a login shell of the user's console account on a terminal, for
+           a member of admins whose console login is on: POST signs the
            user in again for a one-time ticket (see shell_ticket()), GET with it is a WebSocket
            that carries the terminal (see Handler.shell())
   /auth   sign-in with a user's password and TOTP code, refresh and sign-out (see auth())
@@ -50,7 +51,8 @@ with vpnrouter_auth.WEB_KEY (see vpnrouter_auth.verify). A token of /auth names
 /account serves that user, and the other paths need a member of vpnrouter_users.ADMIN_GROUP. A
 token of vpn-router-token has the admin claim and names no user; it may call every path but
 /account, and only such a token may change ADMIN_GROUP: create, rename to it, change, remove it,
-add or take out its members, and remove one of its members. These paths and /auth are not
+add or take out its members, and remove one of its members, and switch a user's console login.
+These paths and /auth are not
 served (404) while the key does not exist. /auth is limited to AUTH_LIMIT calls per client
 address in AUTH_WINDOW seconds; the address of a call from one of web.trusted_proxies, by
 default the address the call came in on, is the last entry of its X-Forwarded-For header.
@@ -512,6 +514,8 @@ def users(state, method, path, body):
       POST   /users/<name>/otp        a new TOTP secret and its otpauth URI; nothing is stored
       PUT    /users/<name>/otp        store a TOTP secret: {"secret", "code"}, code a code of the secret
       DELETE /users/<name>/otp        remove the TOTP token
+      PUT    /users/<name>/console    switch console login on or off: {"enabled", "account"?}, account a local account,
+                                      without which the user's own posixAccount; only a token of vpn-router-token
 
     Service accounts are served by /service-accounts: they are not listed, and a request naming one is 404.
     """
@@ -535,6 +539,7 @@ def users(state, method, path, body):
         ('POST', 3, 'otp'): lambda connection: vpnrouter_users.otp_new(connection, name),
         ('PUT', 3, 'otp'): lambda connection: vpnrouter_users.otp_enrol(connection, name, body.get('secret'), body.get('code')),
         ('DELETE', 3, 'otp'): lambda connection: vpnrouter_users.otp_remove(connection, name),
+        ('PUT', 3, 'console'): lambda connection: vpnrouter_users.console(connection, name, body.get('enabled'), body.get('account')),
     }
     # The vpnrouter_users operation of each route that may revoke refresh tokens.
     operations = {('PUT', 3, 'password'): 'passwd', ('POST', 3, 'disable'): 'disable', ('POST', 3, 'unlock'): 'unlock',
@@ -979,8 +984,11 @@ def refusal(claims, method, path, body):
     with vpnrouter_users.session() as connection:
         if not vpnrouter_users.is_admin(connection, name):
             return f'user {name} is not a member of {admins}'
-        if changes_admins(connection, method, path.strip('/').split('/'), body if isinstance(body, dict) else {}):
+        parts = path.strip('/').split('/')
+        if changes_admins(connection, method, parts, body if isinstance(body, dict) else {}):
             return f'only a token of vpn-router-token may change the group {admins} or remove its members'
+        if parts[0] == 'users' and len(parts) == 3 and parts[2] == 'console' and method != 'GET':
+            return 'only a token of vpn-router-token may change console login'
     return ''
 
 
@@ -1026,7 +1034,7 @@ def shell_ticket(name, body):
 
     The user named by the token signs in again with {"password", "code"?}; a wrong password or code is 403 and counts
     as a failed login. The answer is {"ticket", "expires_in"}: a ticket that opens one shell (GET /shell) for the
-    same user within SHELL_TICKET_SECONDS. 403 while web.shell is false.
+    same user within SHELL_TICKET_SECONDS. 403 while web.shell is false or the user's console login is not on.
     """
     if not isinstance(name, str):
         return 403, {'error': 'the shell needs a token of a signed-in user'}
@@ -1035,6 +1043,8 @@ def shell_ticket(name, body):
     try:
         if not vpnrouter.load_config()['web']['shell']:
             return 403, {'error': 'the shell is disabled; vpn-config-edit set web.shell true enables it'}
+        if console_account(name) is None:
+            return 403, {'error': f'console login is not enabled for {name}; vpn-router-user console sets it'}
         vpnrouter_users.login(name, body.get('password'), body.get('code'))
     except vpnrouter_users.Failure as failure:
         if failure.status == 5:
@@ -1053,6 +1063,13 @@ def shell_ticket(name, body):
     return 200, {'ticket': ticket, 'expires_in': SHELL_TICKET_SECONDS}
 
 
+def console_account(name):
+    """The system account the console of the user runs as, or None while its console login is not on."""
+    with vpnrouter_users.session() as connection:
+        console = vpnrouter_users.summary(vpnrouter_users.entry(connection, name))['console']
+    return console['account'] if console and console['enabled'] else None
+
+
 def take_ticket(name, ticket):
     """Whether the ticket of POST /shell is unexpired and was given to the user; it is used up either way."""
     with _shell_lock:
@@ -1170,7 +1187,8 @@ class Handler(BaseHTTPRequestHandler):
                 return opcode, payload
 
     def shell(self, name):
-        """Answer GET /shell?ticket=<ticket>, a WebSocket handshake, with a login shell of web.shell_user on a terminal.
+        """Answer GET /shell?ticket=<ticket>, a WebSocket handshake, with a login shell of the user's console account
+        (vpnrouter_users.console) on a terminal.
 
         The ticket must come from POST /shell for the user named by the token. Binary messages of the client are its
         keystrokes, a text message {"cols", "rows"} sets the window size, and binary messages of the server are the
@@ -1199,9 +1217,15 @@ class Handler(BaseHTTPRequestHandler):
         if not options['shell']:
             return refuse(403, 'the shell is disabled; vpn-config-edit set web.shell true enables it')
         try:
-            account = pwd.getpwnam(options['shell_user'])
+            login = console_account(name)
+        except (vpnrouter_users.Failure, ldap.LDAPError, OSError) as exc:
+            return refuse(500, f'the user directory failed: {exc}')
+        if login is None:
+            return refuse(403, f'console login is not enabled for {name}')
+        try:
+            account = pwd.getpwnam(login)
         except KeyError:
-            return refuse(500, f'the system user {options["shell_user"]} of web.shell_user does not exist')
+            return refuse(500, f'the system does not know the account {login}; is nslcd running?')
         unit = f'vpn-router-shell-{secrets.token_hex(4)}'
         master, terminal = os.openpty()
         try: