Forum Discussion

epaalx's avatar
epaalx
Icon for Cirrus rankCirrus
Aug 18, 2011

Creating local users when using Remote Authentication

Hi F5'ers,   I'd like to provision (some) local users even though Remote Authentication (using Radius) is provisioned.   F5 removed f5adduser (in 10.1.0), so, what's the sanctioned alternative? ...
basic
getting started
new to f5
Willy's avatar
Willy
Icon for Nimbostratus rankNimbostratus
Nov 13, 2019

I am a bit confused now,in the top rectangle it is mentioned "can't be done".

The next rectangle provides a command for doing it ?

At this moment we are using version 12.1.3.7. Is there any change ?

We would like to use one extra local user on top of the remote users , to run a script for automated backup with keys.

Point is that we would like to take the server the initiative for the actions.

Anyone a suggestion ?

  • Enes_Afsin_Al's avatar
    Enes_Afsin_Al
    Icon for MVP rankMVP
    Nov 14, 2019

    Hi Willy,

    • Enable "Fallback to Local" (System » Users » Authentication)
    • Create a user (System » Users » User List)
    • Run the below command:
    echo "username" >> /config/bigip/auth/localusers
sed -ri 's/(localonlyusers LT_STRING_LIST.*)"/\1 \\{username\\}"/' /etc/confpp.dat
    • Stefan_Klotz's avatar
      Stefan_Klotz
      Icon for Cumulonimbus rankCumulonimbus
      Apr 08, 2021

      Hi Enes,

      these two commands work perfectly on our system.

      But I noticed today (some weeks after implementation), that login with this local user is not possible anymore. I found out, that the changes to your mentioned files were gone. Are these settings maybe not reboot-safe or gets lost during a software update?

      Can you please share some details here and is it possible to have these settings persistent?

      Thank you!

       

      Ciao Stefan :)

    • Enes_Afsin_Al's avatar
      Enes_Afsin_Al
      Icon for MVP rankMVP
      Apr 08, 2021

      Hi Stefan,

       

      The file /config/bigip/auth/localusers is auto-generated and should not be manually edited. After a system reboot it is expected that this configuration will be lost.

       

      You can workaround this, to allow local and remote users to work at all times, by creating a startup script to add the local users to /config/bigip/auth/localusers on every reboot. However, this is not officially developed or supported by F5.

       

      REF: https://support.f5.com/csp/article/K11333640

    • Stefan_Klotz's avatar
      Stefan_Klotz
      Icon for Cumulonimbus rankCumulonimbus
      Apr 29, 2021

      Hi Enes,

      sorry to bother you again, but this manual configurations gets lost even without touching or rebooting the BIG-IP. I had to re-enter both commands now twice within the last two days!

      Any idea, which internal process removes this again? Is automated scripting (via cronjob) the only solution to have these entries permanent?

      Thank you!

       

      Ciao Stefan :)