fix: the shell runs as the console account of each member of admins, a local account or the user's own POSIX account in the directory, which also signs in with SSH and sudo, instead of one web.shell_user.

debian-package/src/usr/sbin/vpn-router-user

@@ -24,6 +24,7 @@ user exists, 1 anything else. -h or --help shows the commands and their options.
   vpn-router-user [--json] otp-new <name>
   vpn-router-user [--json] otp-enrol <name> <code>   (secret on stdin)
   vpn-router-user [--json] otp-remove <name>
+  vpn-router-user [--json] console <name> (--posix | --account LOCAL | --off)
 """
 
 import argparse
@@ -56,6 +57,8 @@ HELP = {
     'otp-new': 'make a TOTP secret and its otpauth URI; nothing is stored',
     'otp-enrol': 'store the TOTP secret read from standard input, when the code is a code of it',
     'otp-remove': 'remove the TOTP token',
+    'console': "switch the console login of a member of admins on, as the user's own POSIX account in the directory "
+               'or as a local account, or off',
 }
 
 #: The help of the person options.
@@ -86,6 +89,11 @@ def parse(argv):
             sub.add_argument('--service', action='store_true', help='add a service account, which cannot sign in to the web service')
         if command == 'otp-enrol':
             sub.add_argument('code', help='a code of the secret from the authenticator')
+        if command == 'console':
+            choice = sub.add_mutually_exclusive_group(required=True)
+            choice.add_argument('--posix', action='store_true', help="run the console as the user's own POSIX account")
+            choice.add_argument('--account', metavar='LOCAL', help='run the console as this local account')
+            choice.add_argument('--off', action='store_true', help='switch console login off')
     return parser.parse_args(argv)
 
 
@@ -108,9 +116,18 @@ def run(connection, options, secret):
         return vpnrouter_users.passwd(connection, options.name, secret)
     if command == 'otp-enrol':
         return vpnrouter_users.otp_enrol(connection, options.name, secret, options.code)
+    if command == 'console':
+        return vpnrouter_users.console(connection, options.name, not options.off, options.account)
     return getattr(vpnrouter_users, command.replace('-', '_'))(connection, options.name)
 
 
+def console_text(console):
+    """The console login of a user as a cell: -, off, posix (uid N) or local and the account."""
+    if console is None or not console['enabled']:
+        return '-' if console is None else 'off'
+    return f'local {console["account"]}' if console['local'] else f'posix (uid {console["uid"]})'
+
+
 def text_of(answer):
     """The answer as text for people."""
     if 'profile' in answer:
@@ -122,11 +139,12 @@ def text_of(answer):
     users = answer['users'] if 'users' in answer else [answer]
     if not users:
         return 'no users'
-    head = ('USER', 'KIND', 'STATE', 'CERTIFICATE', 'OTP', 'FIRST NAME', 'LAST NAME', 'E-MAIL')
+    head = ('USER', 'KIND', 'STATE', 'CERTIFICATE', 'OTP', 'CONSOLE', 'FIRST NAME', 'LAST NAME', 'E-MAIL')
     rows = [(user['name'], 'internal' if user['internal'] else 'service' if user['service'] else 'manager' if user['manager_only'] else 'vpn',
              'disabled' if not user['enabled'] else 'locked' if user['locked'] else 'enabled',
              'issued' if user['certificate'] else 'missing',
-             'enrolled' if user['otp'] else '-', user['first_name'] or '-', user['last_name'] or '-', user['email'] or '-')
+             'enrolled' if user['otp'] else '-', console_text(user['console']),
+             user['first_name'] or '-', user['last_name'] or '-', user['email'] or '-')
             for user in users]
     widths = [max(len(row[column]) for row in (head, *rows)) for column in range(len(head))]
     return '\n'.join('  '.join(cell.ljust(width) for cell, width in zip(row, widths)).rstrip() for row in (head, *rows))