login: T8086: replace getpwall() based user enumeration to avoid NSS/TACACS timeouts #4892
+141
−63
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
… timeouts
The previous implementation of "system login" relied on Python's pwd.getpwall()
to enumerate user accounts. This forces a full walk through the NSS stack,
which is acceptable in general but problematic for our use-case. VyOS only
needs information about locally created accounts and not remote accounts
provided via AAA backends such as TACACS or RADIUS.
When TACACS servers are unreachable, NSS lookups become extremely slow due to
repeated timeouts. As a result, any operation triggering pwd.getpwall()
(including configuration commits) can stall for several minutes.
This change introduces a dedicated helper, get_local_passwd_entries(), which
reads /etc/passwd directly and avoids NSS entirely. Since only local UIDs are
relevant, this provides all required data with no external dependencies.
Performance improvement on VyOS 1.4.3 with two unreachable TACACS servers:
# set system login tacacs server 192.168.1.50 key test123
# set system login tacacs server 192.168.1.51 key test123
# time commit
Before:
real 3m29.825s
user 0m0.329s
sys 0m0.246s
After:
real 0m1.464s
user 0m0.337s
sys 0m0.195s
This significantly improves commit performance and removes sensitivity to AAA
server outages.
…ries() Switch to our custom implementation to avoid NSS/TACACS timeouts as explained in commit 4c9eaaa ("login: replace getpwall() user enumeration to avoid NSS/TACACS timeouts").
…ries() Switch to our custom implementation to avoid NSS/TACACS timeouts as explained in commit 4c9eaaa ("login: replace getpwall() user enumeration to avoid NSS/TACACS timeouts").
c-po
requested review from
dmbaturin,
jestabro,
sarthurdev,
sever-sever and
zdc
c-po
added
bp/sagitta
|
👍 |
|
CI integration 👍 passed! Details
|
sarthurdev
approved these changes
Dec 11, 2025
Member
sarthurdev
left a comment
sarthurdev
left a comment
There was a problem hiding this comment.
Migrates away from pwd module, uses a vyos.utils helper for reading /etc/passwd.
Smoketests pass, not tested locally.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Change summary
The previous implementation of
system loginrelied on Python'spwd.getpwall()to enumerate user accounts. This forces a full walk through the NSS stack, which is acceptable in general but problematic for our use-case. VyOS only needs information about locally created accounts and not remote accounts provided via AAA backends such as TACACS or RADIUS.When TACACS servers are unreachable, NSS lookups become extremely slow due to repeated timeouts. As a result, any operation triggering
pwd.getpwall()(including configuration commits) can stall for several minutes.This change introduces a dedicated helper,
get_local_passwd_entries(), which reads/etc/passwddirectly and avoids NSS entirely. Since only local UIDs are relevant, this provides all required data with no external dependencies.Performance improvement on VyOS 1.4.3 with two unreachable TACACS servers:
Before
After
This significantly improves commit performance and removes sensitivity to AAA server outages.
Types of changes
Related Task(s)
Related PR(s)
How to test / Smoketest result
All smoketests passed:
make test-interfacesmake test-no-interfaces-no-vppmake testcChecklist: