Forum Discussion

epaalx's avatar
epaalx
Icon for Cirrus rankCirrus
Aug 18, 2011

Creating local users when using Remote Authentication

Hi F5'ers,   I'd like to provision (some) local users even though Remote Authentication (using Radius) is provisioned.   F5 removed f5adduser (in 10.1.0), so, what's the sanctioned alternative? ...
basic
getting started
new to f5
Willy's avatar
Willy
Icon for Nimbostratus rankNimbostratus

I am a bit confused now,in the top rectangle it is mentioned "can't be done".

The next rectangle provides a command for doing it ?

At this moment we are using version 12.1.3.7. Is there any change ?

We would like to use one extra local user on top of the remote users , to run a script for automated backup with keys.

Point is that we would like to take the server the initiative for the actions.

Anyone a suggestion ?

Enes_Afsin_Al's avatar
Enes_Afsin_Al
Icon for MVP rankMVP
Nov 14, 2019

Hi Willy,

  • Enable "Fallback to Local" (System » Users » Authentication)
  • Create a user (System » Users » User List)
  • Run the below command:
echo "username" >> /config/bigip/auth/localusers
sed -ri 's/(localonlyusers LT_STRING_LIST.*)"/\1 \\{username\\}"/' /etc/confpp.dat
  • Stefan_Klotz's avatar
    Stefan_Klotz
    Icon for Cumulonimbus rankCumulonimbus
    Apr 08, 2021

    Hi Enes,

    these two commands work perfectly on our system.

    But I noticed today (some weeks after implementation), that login with this local user is not possible anymore. I found out, that the changes to your mentioned files were gone. Are these settings maybe not reboot-safe or gets lost during a software update?

    Can you please share some details here and is it possible to have these settings persistent?

    Thank you!

     

    Ciao Stefan :)

  • Enes_Afsin_Al's avatar
    Enes_Afsin_Al
    Icon for MVP rankMVP
    Apr 08, 2021

    Hi Stefan,

     

    The file /config/bigip/auth/localusers is auto-generated and should not be manually edited. After a system reboot it is expected that this configuration will be lost.

     

    You can workaround this, to allow local and remote users to work at all times, by creating a startup script to add the local users to /config/bigip/auth/localusers on every reboot. However, this is not officially developed or supported by F5.

     

    REF: https://support.f5.com/csp/article/K11333640

  • Stefan_Klotz's avatar
    Stefan_Klotz
    Icon for Cumulonimbus rankCumulonimbus
    Apr 29, 2021

    Hi Enes,

    sorry to bother you again, but this manual configurations gets lost even without touching or rebooting the BIG-IP. I had to re-enter both commands now twice within the last two days!

    Any idea, which internal process removes this again? Is automated scripting (via cronjob) the only solution to have these entries permanent?

    Thank you!

     

    Ciao Stefan :)

  • jaikumar_f5's avatar
    jaikumar_f5
    Icon for MVP rankMVP
    Apr 30, 2021

     

     

    That is the behavior of the box. Please refer the article K11333640.

    To overcome this, you'll have to create a startup script. Which would be on /config/startup.

     

    Did you put the entries there & yet you see this issue ?

    Also note this is pretty 10 year old thread, please open a new thread so it could be addressed properly.