[tacacs]: Add SSH TraceId authorization attribute by Rod-Persky · Pull Request #27667 · sonic-net/sonic-buildimage

Rod-Persky · 2026-06-02T06:37:51Z

Why I did it

Operators correlating SSH activity with TACACS+ audit logs currently have no way to tie a user's interactive shell session to a higher-level request trace. This PR implements the HLD in sonic-net/SONiC#2358 by propagating a client-supplied SSH_CLIENT_TRACEID from the SSH session into per-command TACACS+ authorization requests, so each authorized command carries the originating trace identifier. This PR also depends on sonic-net/sonic-host-services#407 for tacplus_nss configuration support.

Work item tracking

Microsoft ADO (number only): 38265947

How I did it

build_debian.sh: append AcceptEnv SSH_CLIENT_TRACEID to sshd_config (idempotent guard so re-runs don't duplicate the line) so OpenSSH will accept a SSH_CLIENT_TRACEID env var sent by the client via SendEnv.
files/image_config/bash/bash.bashrc: in interactive shells, mark SSH_CLIENT_TRACEID as readonly when present so the user cannot mutate or unset it for the lifetime of the shell.
src/tacacs/bash_tacplus/bash_tacplus.c: new get_trace_id() helper reads $SSH_CLIENT_TRACEID, enforces the TACACS+ 255-byte attribute limit, and rejects any value containing characters outside [A-Za-z0-9._:-|]. send_authorization_message() attaches it as a traceid=<value> attribute on each authorization request when valid; behavior is unchanged when SSH_CLIENT_TRACEID is absent, empty, oversized, or contains unsafe characters (silently dropped with a debug log).
src/tacacs/bash_tacplus/unittest/: extend mock_helper to capture SSH_CLIENT_TRACEID attribute adds, and add 5 CUnit cases covering valid, missing, empty, invalid-character, and oversized values.

How to verify it

Build sonic-vs from this branch and install on a VS testbed configured with TACACS+ authorization.
From a client with SendEnv SSH_CLIENT_TRACEID (or ssh -o SendEnv=SSH_CLIENT_TRACEID), export a value such as SSH_CLIENT_TRACEID=trace-123:abc.def and SSH to the DUT.
Run any command and confirm the TACACS+ server log shows the request with a traceid=trace-123:abc.def attribute alongside the usual cmd/service/protocol attributes.
Verify negative cases: connect without SSH_CLIENT_TRACEID, with an empty value, with an oversized value (>247 chars), and with disallowed characters (e.g. newline, space, ;) — authorization still succeeds and no traceid attribute is sent.
Inside the shell, SSH_CLIENT_TRACEID=other / unset SSH_CLIENT_TRACEID must fail with "readonly variable".
Run the unit tests cd src/tacacs/bash_tacplus/unittest && make && ./plugin_test and all CUnit cases (including the 5 new TraceId tests) must pass.

Which release branch to backport (provide reason below if selected)

Backport requested to 202505 (20250510), 202411 (20241110), and 202305 (20230531) although not required initially as these are major long-lived release trains used in production, and SSH↔TACACS+ traceability is needed for incident correlation on those fleets. The change is small, behind an opt-in env var, and a no-op when TraceId is unset, so the risk profile is acceptable for stable branches.

Tested branch (Please provide the tested image version)

master.

Description for the changelog

[tacacs]: Propagate SSH-supplied SSH_CLIENT_TRACEID env var as a TACACS+ authorization attribute for per-command audit correlation.

Link to config_db schema for YANG module changes

sonic-system-tacacs.yang

A picture of a cute animal (not mandatory but encouraged)

linux-foundation-easycla · 2026-06-02T06:37:57Z

The committers listed above are authorized under a signed CLA.

✅ login: Copilot / name: Copilot (2debd38)
✅ login: Rod-Persky / name: Rod Persky (2debd38)

mssonicbld · 2026-06-02T06:37:59Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-06-02T06:38:12Z

Azure Pipelines successfully started running 1 pipeline(s).

mssonicbld · 2026-06-02T06:44:33Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-06-02T06:44:44Z

Azure Pipelines successfully started running 1 pipeline(s).

mssonicbld · 2026-06-02T11:13:08Z

This PR has backport request for branch(es): 202305,202411,202505.
Added label(s) for branch(es) 202305,202411,202505.

_{---Powered by SONiC BuildBot}

Rod-Persky · 2026-06-03T03:29:45Z

Validated on the pipeline build https://dev.azure.com/mssonic/build/_build/results?buildId=1128509

…uthorization Implements the HLD in sonic-net/SONiC#2358. Accepts a client-supplied `TraceId` env var via OpenSSH AcceptEnv, marks it readonly in the user's initial interactive bash, validates the value, and attaches it as a `TraceId=<value>` attribute on per-command TACACS+ authorization requests. Behavior is unchanged when TraceId is absent or invalid. How to verify it: - Build sonic-vs and SSH with `SendEnv TraceId` set to a valid value; confirm authorization requests include the TraceId attribute and that invalid/oversized values are silently dropped. - Run the bash_tacplus unit tests under src/tacacs/bash_tacplus/unittest/. Signed-off-by: Rod Persky <770327+Rod-Persky@users.noreply.github.com>

mssonicbld · 2026-06-03T07:14:06Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-06-03T07:14:19Z

Azure Pipelines successfully started running 1 pipeline(s).

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds support for propagating an SSH client-supplied TraceId into TACACS+ authorization attributes, along with unit tests and OS image configuration to pass and protect the environment variable.

Changes:

Add TraceId parsing/validation and include it as a TACACS+ attribute in authorization requests.
Add unit tests and mock tracking for the TraceId attribute behavior.
Configure SSHD to accept TraceId via AcceptEnv and make TraceId readonly in interactive shells.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/tacacs/bash_tacplus/unittest/plugin_test.c	Adds TraceId-related unit tests for authorization message behavior
src/tacacs/bash_tacplus/unittest/mock_helper.h	Declares mock state and reset helper for TraceId attribute capture
src/tacacs/bash_tacplus/unittest/mock_helper.c	Implements mock capture/reset of TraceId attribute in `tac_add_attrib`
src/tacacs/bash_tacplus/bash_tacplus.c	Implements TraceId validation/extraction and adds it to TACACS+ attributes
files/image_config/bash/bash.bashrc	Makes `TraceId` readonly (best-effort) in interactive shells
build_debian.sh	Ensures sshd_config includes `AcceptEnv TraceId`

Signed-off-by: Rod Persky <770327+Rod-Persky@users.noreply.github.com>

mssonicbld · 2026-06-05T03:21:17Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-06-05T03:21:30Z

Azure Pipelines successfully started running 1 pipeline(s).

auspham · 2026-06-05T09:49:46Z

/azpw retry

mssonicbld · 2026-06-05T09:49:55Z

Retrying failed(or canceled) jobs...

mssonicbld · 2026-06-05T09:49:57Z

No failed(or canceled) jobs found in completed stages. Only failed(or canceled) jobs in completed stages can be retried.

Stages in progress: Test. Please wait for the stages to complete and then retry again.

Rod-Persky · 2026-06-10T03:23:58Z

@qiluo-msft this is a change into the existing sonic-bash plugin to capture an end to end trace ID. There is also a corresponding HLD sonic-net/SONiC#2358 . Could you please assist in identifying next steps please

mssonicbld · 2026-06-10T11:40:50Z

The backport request for branch(es) 202305,202411,202505 has been removed from PR description. Removed label(s)....

_{---Powered by SONiC BuildBot}

…into dev/rodpersky/sonic-tracability

mssonicbld · 2026-07-07T08:29:55Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-07-07T08:30:09Z

Azure Pipelines successfully started running 1 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Signed-off-by: Rod Persky <770327+Rod-Persky@users.noreply.github.com>

mssonicbld · 2026-07-09T02:00:20Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-07-09T02:00:49Z

Azure Pipelines successfully started running 1 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 7 comments.

Signed-off-by: Rod Persky <770327+Rod-Persky@users.noreply.github.com>

mssonicbld · 2026-07-10T07:33:18Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-07-10T07:33:33Z

Azure Pipelines successfully started running 1 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Rod-Persky mentioned this pull request Jun 2, 2026

TACACS+ TraceId documentation and update HLD sonic-net/SONiC#2358

Open

1 task

Rod-Persky force-pushed the dev/rodpersky/sonic-tracability branch from fa88a91 to 2debd38 Compare June 2, 2026 06:44

mssonicbld added Request for 202305 Branch Request for 202411 Branch Request for 202505 Branch labels Jun 2, 2026

mssonicbld added Cherry Pick Conflict_202411 Cherry Pick Conflict_202305 labels Jun 2, 2026

liamkearney-msft requested review from qiluo-msft and saiarcot895 June 3, 2026 01:18

Rod-Persky force-pushed the dev/rodpersky/sonic-tracability branch from 2debd38 to f26d2a4 Compare June 3, 2026 07:00

Rod-Persky marked this pull request as ready for review June 4, 2026 08:31

Rod-Persky requested a review from lguohan as a code owner June 4, 2026 08:31

Copilot AI review requested due to automatic review settings June 4, 2026 08:31

Copilot AI reviewed Jun 4, 2026

View reviewed changes

Comment thread src/tacacs/bash_tacplus/unittest/mock_helper.c

Comment thread src/tacacs/bash_tacplus/unittest/plugin_test.c Outdated

Comment thread src/tacacs/bash_tacplus/bash_tacplus.c Outdated

Updates for copilot PR review

612b85c

Signed-off-by: Rod Persky <770327+Rod-Persky@users.noreply.github.com>

mssonicbld removed Request for 202305 Branch Request for 202411 Branch Request for 202505 Branch labels Jun 10, 2026

Merge branch 'master' of https://github.com/sonic-net/sonic-buildimage …

63c887a

…into dev/rodpersky/sonic-tracability

Copilot AI review requested due to automatic review settings July 7, 2026 08:29

Copilot started reviewing on behalf of Rod-Persky July 7, 2026 08:30 View session

Copilot AI reviewed Jul 7, 2026

View reviewed changes

Comment thread src/tacacs/bash_tacplus/unittest/plugin_test.c

Comment thread src/tacacs/bash_tacplus/bash_tacplus.c

[feature] update SSH_CLIENT_TRACEID support for TACACS+ authorization

0168896

Signed-off-by: Rod Persky <770327+Rod-Persky@users.noreply.github.com>

Copilot AI review requested due to automatic review settings July 9, 2026 02:00

Rod-Persky requested review from dgsudharsan, praveen-li and venkatmahalingam as code owners July 9, 2026 02:00

Copilot started reviewing on behalf of Rod-Persky July 9, 2026 02:00 View session

Copilot AI reviewed Jul 9, 2026

View reviewed changes

Rod-Persky mentioned this pull request Jul 9, 2026

[tacacs]: Add SSH TraceId authorization attribute support sonic-net/sonic-host-services#407

Open

Update from copilot review, and added support for | trace id from dotnet

865a8b9

Signed-off-by: Rod Persky <770327+Rod-Persky@users.noreply.github.com>

Copilot AI review requested due to automatic review settings July 10, 2026 07:33

Copilot started reviewing on behalf of Rod-Persky July 10, 2026 07:33 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

Comment thread build_debian.sh

Comment thread src/tacacs/bash_tacplus/bash_tacplus.c

Uh oh!

Conversation

Rod-Persky commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why I did it

Work item tracking

How I did it

How to verify it

Which release branch to backport (provide reason below if selected)

Tested branch (Please provide the tested image version)

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

Uh oh!

linux-foundation-easycla Bot commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mssonicbld commented Jun 2, 2026

Uh oh!

azure-pipelines Bot commented Jun 2, 2026

Uh oh!

mssonicbld commented Jun 2, 2026

Uh oh!

azure-pipelines Bot commented Jun 2, 2026

Uh oh!

mssonicbld commented Jun 2, 2026

Uh oh!

Rod-Persky commented Jun 3, 2026

Uh oh!

mssonicbld commented Jun 3, 2026

Uh oh!

azure-pipelines Bot commented Jun 3, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mssonicbld commented Jun 5, 2026

Uh oh!

azure-pipelines Bot commented Jun 5, 2026

Uh oh!

auspham commented Jun 5, 2026

Uh oh!

mssonicbld commented Jun 5, 2026

Uh oh!

mssonicbld commented Jun 5, 2026

Uh oh!

Rod-Persky commented Jun 10, 2026

Uh oh!

mssonicbld commented Jun 10, 2026

Uh oh!

mssonicbld commented Jul 7, 2026

Uh oh!

azure-pipelines Bot commented Jul 7, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

mssonicbld commented Jul 9, 2026

Uh oh!

azure-pipelines Bot commented Jul 9, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Rod-Persky commented Jun 2, 2026 •

edited

Loading

linux-foundation-easycla Bot commented Jun 2, 2026 •

edited

Loading