Skip to content

Conversation

@brandonbiggs
Copy link
Contributor

This PR adds two new configuration items in /etc/ood/config/nginx_stage.yml.

  • disable_nginx_stage_help_message: true/false
  • disabled_shell_message: string message that gets displayed when a user has a disabled shell

Most folks running OOD would never need to worry about this. But this is helpful for those who do need to configure disabled_shell.

With the current installation, and the new installation, here is what is shown when a user has a disabled_shell.

# /opt/ood/nginx_stage/sbin/nginx_stage pun --user username
user has disabled shell: username
Run 'nginx_stage --help' to see a full list of available command line options.

When disable_nginx_stage_help_message: true in nginx_stage.yml:

# /opt/ood/nginx_stage/sbin/nginx_stage pun --user username
user has disabled shell: username

Second line is hidden.

When disabled_shell_message: 'this is a test':

# /opt/ood/nginx_stage/sbin/nginx_stage pun --user username
this is a test

Defining two new variables that can be defined in `nginx_stage.yml` for better customization of error messages that appear when blocking a user by a restricted shell.
Added a conditional for hiding the stderr nginx_stage help message.
Use the custom or default disabled shell message defined either in nginx_stage.yml or in configuration.rb
@johrstrom
Copy link
Contributor

My guess is tests will fail because you need to add these to the example template file: https://github.com/OSC/ondemand/blob/master/nginx_stage/share/nginx_stage_example.yml (we run tests to be sure that any configuration is also listed in this example config)

self.min_uid = 1000
self.disabled_shell = '/access/denied'
self.disabled_shell_message = 'user has a disabled shell: %s'
self.disable_nginx_stage_help_message = false
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't like double negatives here. Instead of disable set to false can we have just nginx_stage_help_message set to true?

Or maybe it's show_nginx_stage_help_message set to true?

It's just the double negatives that make it hard to understand at a glance.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense to me. I like the show_nginx_stage_help_message = true

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay, this should be updated.

@brandonbiggs
Copy link
Contributor Author

My guess is tests will fail because you need to add these to the example template file: https://github.com/OSC/ondemand/blob/master/nginx_stage/share/nginx_stage_example.yml (we run tests to be sure that any configuration is also listed in this example config)

I'll get this fixed too.

Got rid of the double negative.
Got rid of the double negative
Added the new options to the example config.
@brandonbiggs
Copy link
Contributor Author

My guess is tests will fail because you need to add these to the example template file: https://github.com/OSC/ondemand/blob/master/nginx_stage/share/nginx_stage_example.yml (we run tests to be sure that any configuration is also listed in this example config)

Okay, I've added this as well.

@johrstrom johrstrom merged commit e881d48 into OSC:master Aug 7, 2025
20 checks passed
brandonbiggs added a commit to brandonbiggs/ood-documentation that referenced this pull request Aug 12, 2025
Add documentation for two new nginx_stage options per a recent commit - OSC/ondemand#4511
johrstrom pushed a commit to OSC/ood-documentation that referenced this pull request Aug 12, 2025
)

Add documentation for two new nginx_stage options per a recent commit - OSC/ondemand#4511
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants