Is it posible to have multiple admins for yunohost? The use case is: Lets say, i have two domains configured in the yunohost as domain1.com and domain2.com and i would like to have different dedicated admin for respective domain so that any further installations or changes made by admin1 (related to domain1.com) will have impact only to those apps configured to domain1.com only.
This use case has become a critical need to move into production live as multiple admins should access their own domain based yunohosts rather than a common one.
Is there any workaround or a way to solve this issue please.
The main aim of Yunohost is to provide self-hosting solution for people who are not good with installing servers and maintaining it. Considering this there was never a requirement of to have multiple admin account.
A multiple account would make things even more complex. What if the a admin forgot his password, will there a super admin? Maintaining multi-instance apps, right to ssh and more complex problems. Certainly Yunohost is not a commercializing hosting product, these are not the goals for YunoHost and will never be priority for Yunohost. There are more sophisticated platform available for these type of requirement which would do the work far better then Yunohost. Its better to use them instead of using Yunohost and then going back to them.
Anyways,its just my point of view, you can fork Yunohost as its an open source project and change it according to your needs.
Recently, YunoHost team has quickly discussed to put several admins accounts because @Josue prepares a work on groups management and improvement in our ldap structure.
We never consider the idea to restrict an administrator to a domain, indeed it’s a very big feature if one day we decide to do it.
Currently, the app packaging system allows scripts of apps packages to do everything on system (scripts are ran as root). So an administrator can do everything, if this admin can install some app. To support your suggested feature, it needs :
an optional feature to install an app inside a container
a permission management system inside our cli/webadmin
probably several others adaptations in our codes
As explained by @kanhu, this feature could be pretty useful for communities or professional hosting, BUT our primary goal is to simplify personal hosting and democratize it. Of course, a small group like a family or a house share could use this kind of feature when a member of the group want to make its own server… but it’s an advanced use case, and we have a lot of other features to create.
That’s why I think, this feature will not be prioritize compared to the current roadmap we have created the last week.
Thank you for update and agree to your points. however iam looking at another need and just need your inputs on this as well…
I need 2 persons as admins so that each will handle some set of applications and users. in short it is like: i create a user group as Group1 who should have access to app1, app2, app3 only. I create another group as Group2 who should have access to app3, app4, app5 only. - This is from users perspective.
From admins perspective: I need admin1 to configure, replicate or do some work (configurations,upgrades, etc) on app1, app2 and app3 only as admin1 is more skilled on those apps. and Admin2 will work on app4 and app5 as he is more skilled on those apps.
Apart from sharing the main admin password across admin1 and admin2, is there any alternative?
Any news on this topic?
We are also considering using Yunohost for small communities servers and having multiple admin accounts would be a blessing instead of having to share one admin password for everybody.
What kind of users are those admins (somewhat computer savvy, real admins, totally without experience?), and what specific reasons against sharing one admin account (I can imagine a few, but don’t know what applies in your case)?
Running ahead: if the admins know their way around a CLI, you could consider enabling SSH access via public key and change/disable the password. Via the SSH configuration and the sudo configuration you can somewhat limit the available commands.
That way none of the admins could use the web GUI, but if you want to retract any admin’s access to Yunohost, you can remove their key. There is some amount of trust involved of course, as long as they have access, they can add more access for future use.
For yourself you could add another SSH account with sudo root rights, without command limitations.
FWIW, it seems it’s not too hard to add supplementary admin accounts, in terms of allowed to perform low level sysadmin in the underlying host, by creating a user with adduser (regular system user, done through SSH), then adding them to the admins group in LDAP (made it with the phpldapadmin app once installed), and then adding them to the sudoers group, in LDAP too. Thus being in admins group they are granted SSH access to the machine. Still, supporting several admin accounts in the Web Admin UI would still be an issue.
My use case is I want to help a web developer friend to host his websites and manage his domain names without being a super user. He would have access only to the creation of domains and installation of app on his domains and an sftp access to upload files.
This could maybe be achieve with an application that would give access to the domain and application api. Like a limited version of the one used by the admin user and using a kind of sudo to install stuffs.
