vyos-1x.git/interface-definitions/ssh.xml.in, branch 1.4.0-epa1

T5474: establish common file name pattern for XML conf mode commands

2024-01-01T08:25:32+00:00

We will use _ as CLI level divider. The XML definition filename and also the Python helper should match the CLI node. Example: set interfaces ethernet -> interfaces_ethernet.xml.in set interfaces bond -> interfaces_bond.xml.in set service dhcp-server -> service_dhcp-server-xml.in (cherry picked from commit 4ef110fd2c501b718344c72d495ad7e16d2bd465)

ssh: T4720: Ability to configure SSH-server HostKeyAlgorithms

2022-10-17T12:15:22+00:00

Ability to configure SSH-server HostKeyAlgorithms. Specifies the host key signature algorithms that the server offers. Can accept multiple values.

ssh: T4716: Ablity to configure RekeyLimit data and time

2022-10-10T12:52:54+00:00

Ability to configure SSH RekeyLimit data (in Megabytes) and time (in Minutes) set service ssh rekey data 1024 set service ssh rekey time 60

sshguard: T4408: rename whitelist-address -> allow-from

2022-05-13T16:43:09+00:00

We do not only allow individual host addresses but also prefixes.

sshguard: T4408: Add service ssh dynamic-protection

2022-05-12T17:27:38+00:00

Sshguard protects hosts from brute-force attacks Can inspect logs and block "bad" addresses by threshold Auto-generate rules for nftables When service stopped all generated rules are deleted nft "type filter hook input priority filter - 10" set service ssh dynamic-protection set service ssh dynamic-protection block-time 120 set service ssh dynamic-protection detect-time 1800 set service ssh dynamic-protection threshold 30 set service ssh dynamic-protection whitelist-address 192.0.2.1

ssh: T4273: bugfix cipher and key-exchange multi nodes

2022-02-28T13:28:55+00:00

After hardning the regex validator to be preceeded with ^ and ending with $ it was no longer possible to have a comma separated list as SSH ciphers. The migrations cript is altered to migrate the previous comma separated list to individual multi node entries - cipher and key-exchange always had been multinodes - so this just re-arranges some values and does not break CLI compatibility

scripts: T4269: node.def generator should automatically add default values

2022-02-24T21:47:12+00:00

Since introducing the XML node it was common, but redundant, practice to also add a help string indicating which value would be used as default if the node is unset. This makes no sense b/c it's duplicated code/value/characters and prone to error. The node.def scripts should be extended to automatically render the appropriate default value into the CLI help string. For e.g. SSH the current PoC renders: $ cat templates-cfg/service/ssh/port/node.def multi: type: txt help: Port for SSH service (default: 22) val_help: u32:1-65535; Numeric IP port ... Not all subsystems are already migrated to get_config_dict() and make use of the defaults() call - those subsystems need to be migrated, first before the new default is added to the CLI help.

xml: add missing "u32:" value declarator on integer ranges

2021-08-29T12:48:53+00:00

xml: remove superfluous "interface" prefix from interface includes

2021-08-20T15:17:58+00:00

xml: ssh: move user/group definition to includable files

2021-06-10T19:35:07+00:00