From c5774b1dacb5c4bc67d2bf6f63ed92a296923220 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Sun, 13 May 2018 14:10:15 +0200
Subject: T632: use multi node for SSH allow/deny users and groups

---
 interface-definitions/ssh.xml | 54 ++++++++++++++++++++++++++-----------------
 1 file changed, 33 insertions(+), 21 deletions(-)

(limited to 'interface-definitions')

diff --git a/interface-definitions/ssh.xml b/interface-definitions/ssh.xml
index f898f3934..7b16939c6 100644
--- a/interface-definitions/ssh.xml
+++ b/interface-definitions/ssh.xml
@@ -13,29 +13,41 @@
         <children>
           <node name="access-control">
             <properties>
-                <help>SSH user/group access controls. Directives are processed in this: deny-users, allow-users, deny-groups and allow-groups</help>
+              <help>SSH user/group access controls. Directives are processed in this: deny-users, allow-users, deny-groups and allow-groups</help>
             </properties>
             <children>
-              <leafNode name="allow-groups">
-                <properties>
-                  <help>Configure sshd_config access control for allowed groups</help>
-                </properties>
-              </leafNode>
-              <leafNode name="allow-users">
-                <properties>
-                  <help>Configure sshd_config access control for allowed users</help>
-                </properties>
-              </leafNode>
-              <leafNode name="deny-groups">
-                <properties>
-                  <help>Configure sshd_config access control for disallowed groups</help>
-                </properties>
-              </leafNode>
-              <leafNode name="deny-users">
-                <properties>
-                  <help>Configure sshd_config access control for disallowed users</help>
-                </properties>
-              </leafNode>
+              <node name="allow">
+                <children>
+                  <leafNode name="group">
+                    <properties>
+                      <help>Login is allowed for users whose primary or supplementary group matches</help>
+                      <multi/>
+                    </properties>
+                  </leafNode>
+                  <leafNode name="user">
+                    <properties>
+                      <help>Login is allowed only for user names that match</help>
+                      <multi/>
+                    </properties>
+                  </leafNode>
+                </children>
+              </node>
+              <node name="deny">
+                <children>
+                  <leafNode name="group">
+                    <properties>
+                      <help>Login is disallowed for users whose primary or supplementary group matches</help>
+                      <multi/>
+                    </properties>
+                  </leafNode>
+                  <leafNode name="user">
+                    <properties>
+                      <help>Login is disallowed for user names that match</help>
+                      <multi/>
+                    </properties>
+                  </leafNode>
+                </children>
+              </node>
             </children>
           </node>
           <leafNode name="allow-root">
-- 
cgit v1.2.3


From 0c42107faa0fb4fedccab6746bf90a0f02b86bc9 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Mon, 14 May 2018 11:17:40 +0200
Subject: T632: allow multiple algoorithms for: Ciper, KEX, MACs

---
 interface-definitions/ssh.xml    |  9 ++++++---
 src/conf-mode/vyos-config-ssh.py | 18 ++++++------------
 2 files changed, 12 insertions(+), 15 deletions(-)

(limited to 'interface-definitions')

diff --git a/interface-definitions/ssh.xml b/interface-definitions/ssh.xml
index 7b16939c6..79dff0548 100644
--- a/interface-definitions/ssh.xml
+++ b/interface-definitions/ssh.xml
@@ -57,10 +57,11 @@
           </leafNode>
           <leafNode name="ciphers">
             <properties>
-              <help>Allowed ciphers</help>
+              <help>Specifies allowed Ciphers</help>
               <completionHelp>
                 <script>ssh -Q cipher | tr '\n' ' '</script>
               </completionHelp>
+              <multi/>
             </properties>
           </leafNode>
           <leafNode name="disable-host-validation">
@@ -75,10 +76,11 @@
           </leafNode>
           <leafNode name="key-exchange">
             <properties>
-              <help>Key exchange algorithms</help>
+              <help>Specifies available KEX (Key Exchange) algorithms</help>
               <completionHelp>
                 <script>ssh -Q kex | tr '\n' ' '</script>
               </completionHelp>
+              <multi/>
             </properties>
           </leafNode>
           <leafNode name="listen-address">
@@ -126,10 +128,11 @@
           </leafNode>
           <leafNode name="mac">
             <properties>
-              <help>Allowed message authentication algorithms</help>
+                <help>Specifies available MAC (message authentication code) algorithms</help>
               <completionHelp>
                 <script>ssh -Q mac | tr '\n' ' '</script>
               </completionHelp>
+              <multi/>
             </properties>
           </leafNode>
           <leafNode name="port">
diff --git a/src/conf-mode/vyos-config-ssh.py b/src/conf-mode/vyos-config-ssh.py
index e7528ae83..d09219caa 100755
--- a/src/conf-mode/vyos-config-ssh.py
+++ b/src/conf-mode/vyos-config-ssh.py
@@ -89,7 +89,7 @@ ListenAddress {{ a }}
 # Specifies the ciphers allowed. Multiple ciphers must be comma-separated.
 #
 # NOTE: As of now, there is no 'multi' node for 'ciphers', thus we have only one :/
-Ciphers {{ ciphers }}
+Ciphers {{ ciphers | join(",") }}
 {% endif %}
 
 {% if mac -%}
@@ -98,7 +98,7 @@ Ciphers {{ ciphers }}
 # comma-separated.
 #
 # NOTE: As of now, there is no 'multi' node for 'mac', thus we have only one :/
-MACs {{ mac }}
+MACs {{ mac | join(",") }}
 {% endif %}
 
 {% if key_exchange -%}
@@ -106,7 +106,7 @@ MACs {{ mac }}
 # be comma-separated.
 #
 # NOTE: As of now, there is no 'multi' node for 'key-exchange', thus we have only one :/
-KexAlgorithms {{ key_exchange }}
+KexAlgorithms {{ key_exchange | join(",") }}
 {% endif %}
 
 {% if allow_users -%}
@@ -175,9 +175,7 @@ def get_config():
         ssh['allow-root'] = 'yes'
 
     if conf.exists('ciphers'):
-        # TODO: OpenSSH supports having multiple Ciphers configured. VyOS CLI
-        # yet has no multi node for this. See T632 in phabricator.
-        ciphers = conf.return_value('ciphers')
+        ciphers = conf.return_values('ciphers')
         ssh.setdefault('ciphers', ciphers)
 
     if conf.exists('disable-host-validation'):
@@ -187,9 +185,7 @@ def get_config():
         ssh['password_authentication'] = 'no'
 
     if conf.exists('key-exchange'):
-        # TODO: OpenSSH supports having multiple KEYX methods configured. VyOS CLI
-        # yet has no multi node for this. See T632 in phabricator.
-        kex = conf.return_value('key-exchange')
+        kex = conf.return_values('key-exchange')
         ssh.setdefault('key_exchange', kex)
 
     if conf.exists('listen-address'):
@@ -208,9 +204,7 @@ def get_config():
         ssh['log_level'] = conf.return_value('loglevel')
 
     if conf.exists('mac'):
-        # TODO: OpenSSH supports having multiple MACs configured. VyOS CLI
-        # yet has no multi node for this. See T632 in phabricator.
-        mac = conf.return_value('mac')
+        mac = conf.return_values('mac')
         ssh.setdefault('mac', mac)
 
     if conf.exists('port'):
-- 
cgit v1.2.3