9 files changed, 237 insertions, 51 deletions
diff --git a/docs/appendix/vyos-on-baremetal.rst b/docs/appendix/vyos-on-baremetal.rst
index 36c58317..79835e7d 100644
--- a/docs/appendix/vyos-on-baremetal.rst
+++ b/docs/appendix/vyos-on-baremetal.rst
@@ -76,7 +76,7 @@ Pictures
 PC Engines APU4
 ***************
 
-As this platform seems to be quiet common in terms of noise, cost, power and
+As this platform seems to be quite common in terms of noise, cost, power and
 performance it makes sense to write a small installation manual.
 
 This guide was developed using an APU4C4 board with the following specs:
diff --git a/docs/contributing/build-vyos.rst b/docs/contributing/build-vyos.rst
index 26a9c674..6a312bf8 100644
--- a/docs/contributing/build-vyos.rst
+++ b/docs/contributing/build-vyos.rst
@@ -36,6 +36,8 @@ To be able to use Docker_, the current non-root user should be added to the
 
 .. note:: The build process needs to be built on a local file system, building
    on SMB or NFS shares will result in the container failing to build properly!
+   VirtualBox Drive Share is also not an option as block device operations 
+   are not implemented and the drive is always mounted as "nodev"
 
 Build Docker Container
 ----------------------
@@ -51,12 +53,13 @@ The container can always be built directly from source:
 .. code-block:: none
 
   $ git clone -b current --single-branch https://github.com/vyos/vyos-build
+  $ cd vyos-build
   $ docker build -t vyos/vyos-build docker
 
-.. note: The container is automatically downloaded from Dockerhub if it is not
+.. note:: The container is automatically downloaded from Dockerhub if it is not
    found on your local machine when the below command is executed.
 
-.. note: We require one container per build branch, this means that the used
+.. note:: We require one container per build branch, this means that the used
    container in ``crux`` and ``current`` can and will differ once VyOS makes
    the move towards Debian (10) Buster.
 
@@ -76,6 +79,10 @@ a fresh build of the VyOS ISO can begin.
                                --build-type release --version 1.2.0
   vyos_bld@d4220bb519a0:/vyos# sudo make iso
 
+.. note:: Attempting to use the docker build image on MacOS or Windows will fail
+   as docker does not expose all the filesystem feature required to the container.
+   Building within a VirtualBox server on Mac or Windows is however possible.
+
 To select the container you want to run, you need to specify the branch you are
 interested in, this can be easily done by selecting the appropriate container
 image:
@@ -131,8 +138,8 @@ found in any Debian Upstream mirrror. Those packages can be found at the VyOS
 GitHub project (https://github.com/vyos) and there is a nice helper script
 available to build and list those individual packages.
 
-`scripts/build-packages` provides an easy interface to automate the process 
-of building all VyOS related packages that are not part of the upstream Debian 
+`scripts/build-packages` provides an easy interface to automate the process
+of building all VyOS related packages that are not part of the upstream Debian
 version. Execute it in the root of the `vyos-build` directory to start
 compilation.
 
@@ -141,7 +148,7 @@ compilation.
   $  scripts/build-packages -h
   usage: build-packages [-h] [-c | -k | -f] [-v] [-l] [-b BUILD [BUILD ...]]
                         [-p] [--blacklist BLACKLIST [BLACKLIST ...]]
-  
+
   optional arguments:
     -h, --help            show this help message and exit
     -c, --clean           Re-clone required Git repositories
@@ -369,7 +376,7 @@ Drivers are build as part of the Kernel Pipeline - read above.
 Accel-PPP
 ^^^^^^^^^
 
-Accel-PPP used to be an upstream fork for quiet some time but now has been
+Accel-PPP used to be an upstream fork for quite some time but now has been
 converted to make use of the upstream source code and build system.
 
 It is build as part of the Kernel Pipeline - read above.
diff --git a/docs/contributing/development.rst b/docs/contributing/development.rst
index 220dd362..009e84f7 100644
--- a/docs/contributing/development.rst
+++ b/docs/contributing/development.rst
@@ -201,7 +201,7 @@ Formatting
 * Python: Tabs **shall not** be used. Every indentation level should be 4 spaces
 * XML: Tabs **shall not** be used. Every indentation level should be 2 spaces
 
-.. note: There are extensions to e.g. VIM (xmllint) which will help you to get
+.. note:: There are extensions to e.g. VIM (xmllint) which will help you to get
    your indention levels correct. Add to following to your .vimrc file:
    ``au FileType xml setlocal equalprg=xmllint\ --format\ --recover\ -\
    2>/dev/null`` now you can call the linter using ``gg=G`` in command mode.
diff --git a/docs/high-availability.rst b/docs/high-availability.rst
index 1ee59a7f..ad714597 100644
--- a/docs/high-availability.rst
+++ b/docs/high-availability.rst
@@ -70,7 +70,7 @@ A sync group allows VRRP groups to transition together.
 
 .. code-block:: none
 
-    edit high-availability
+    edit high-availability vrrp
     set sync-group MAIN member VLAN9
     set sync-group MAIN member VLAN20
 
diff --git a/docs/interfaces/tunnel.rst b/docs/interfaces/tunnel.rst
index 87de9000..46e0a9da 100644
--- a/docs/interfaces/tunnel.rst
+++ b/docs/interfaces/tunnel.rst
@@ -42,7 +42,7 @@ An example:
 
 .. code-block:: none
 
-  set interfaces tunnel tun0 encapsulation ipip
+  set interfaces tunnel tun0 encapsulation ip6ip6
   set interfaces tunnel tun0 local-ip 2001:db8:aa::1/64
   set interfaces tunnel tun0 remote-ip 2001:db8:aa::2/64
   set interfaces tunnel tun0 address 2001:db8:bb::1/64
diff --git a/docs/routing/ospf.rst b/docs/routing/ospf.rst
index acffb7b3..e29ad2ab 100644
--- a/docs/routing/ospf.rst
+++ b/docs/routing/ospf.rst
@@ -17,19 +17,19 @@ OSPFv2 (IPv4)
 ^^^^^^^^^^^^^
 
 In order to have a VyOS system exchanging routes with OSPF neighbors, you will
-at least need to configure the area and a network,
+at least need to configure an OSPF area and some network.
 
 .. code-block:: none
 
   set protocols ospf area 0 network 192.168.0.0/24
 
-as well as the router ID.
+That is the minimum configuration you will need.
+It is a good practice to define the router ID too.
 
 .. code-block:: none
 
   set protocols ospf parameters router-id 10.1.1.1
 
-That is the minimum configuration you will need.
 
 Below you can see a typical configuration using 2 nodes, redistribute loopback
 address and the node 1 sending the default route:
diff --git a/docs/services/sstp-server.rst b/docs/services/sstp-server.rst
index 7c381416..6e311e19 100644
--- a/docs/services/sstp-server.rst
+++ b/docs/services/sstp-server.rst
@@ -4,34 +4,36 @@
 SSTP Server
 ###########
 
-VyOS utilizes accel-ppp_ to provide SSTP server functionality. It can be
-used with local authentication or a connected RADIUS server.
+:abbr:`SSTP (Secure Socket Tunneling Protocol)` is a form of :abbr:`VPN
+(Virtual Private Network)` tunnel that provides a mechanism to transport PPP
+traffic through an SSL/TLS channel. SSL/TLS provides transport-level security
+with key negotiation, encryption and traffic integrity checking. The use of
+SSL/TLS over TCP port 443 allows SSTP to pass through virtually all firewalls
+and proxy servers except for authenticated web proxies.
 
-.. note:: Please be aware, due to an upstream bug, config changes/commits
-   will restart the ppp daemon and will reset existing PPPoE connections from
-   connected users, in order to become effective.
+SSTP is available for Linux, BSD, and Windows.
 
-Configuration
-=============
+VyOS utilizes accel-ppp_ to provide SSTP server functionality. We support both
+local and RADIUS authentication.
+
+As SSTP provides PPP via a SSL/TLS channel the use of either publically signed
+certificates as well as a private PKI is required.
 
-The `Secure Socket Tunneling Protocol`_ (SSTP), provides ppp via a SSL/TLS
-channel. Using publically signed certificates as well a by private PKI, is
-fully supported. All certificates should be stored on VyOS under
-``/config/user-data/sstp``.
+.. note:: All certificates should be stored on VyOS under
+  ``/config/user-data/sstp``. If certificates are not stored unt ``/config``
+  they will not be migrated during a software update.
 
 Self Signed CA and Certificates
--------------------------------
+===============================
 
 To generate the CA, the server private key and certificates the following
 commands can be used.
 
 .. code-block:: none
 
-  vyos@vyos:~$ conf
-  [edit]
-  vyos@vyos# mkdir -p /config/user-data/sstp && cd /config/user-data/sstp
-  [edit]
-  openssl req -newkey rsa:4096 -new -nodes -x509 -days 3650 -keyout server.key -out server.crt
+
+  vyos@vyos:~$ mkdir -p /config/user-data/sstp
+  vyos@vyos:~$ openssl req -newkey rsa:4096 -new -nodes -x509 -days 3650 -keyout /config/user-data/sstp/server.key -out /config/user-data/sstp/server.crt
 
   Generating a 4096 bit RSA private key
   .........................++
@@ -46,7 +48,7 @@ commands can be used.
   Common Name (e.g. server FQDN or YOUR name) []:
   Email Address []:
 
-  vyos@vyos# openssl req -new -x509 -key server.key -out ca.crt
+  vyos@vyos:~$ openssl req -new -x509 -key /config/user-data/sstp/server.key -out /config/user-data/sstp/ca.crt
   [...]
   Country Name (2 letter code) [AU]:
   State or Province Name (full name) [Some-State]:
@@ -56,22 +58,205 @@ commands can be used.
   Common Name (e.g. server FQDN or YOUR name) []:
   Email Address []:
 
-The example below will answer configuration request for the user ``foo``.
+
+Configuration
+=============
+
+.. cfgcmd:: set service sstp-server authentication local-users username <user> password <pass>
+
+  Create `<user>` for local authentication on this system. The users password
+  will be set to `<pass>`.
+
+.. cfgcmd:: set service sstp-server authentication protocols <pap | chap | mschap | mschap-v2>
+
+  Require the peer to authenticate itself using one of the following protocols:
+  pap, chap, mschap, mschap-v2.
+
+.. cfgcmd:: set service sstp-server authentication mode <local | radius>
+
+  Set authentication backend. The configured authentication backend is used
+  for all queries.
+
+  * **radius**: All authentication queries are handled by a configured RADIUS
+    server.
+  * **local**: All authentication queries are handled locally.
+
+
+.. cfgcmd:: set service sstp-server network-settings client-ip-settings gateway-address <gateway>
+
+  Specifies single `<gateway>` IP address to be used as local address of PPP
+  interfaces.
+
+
+.. cfgcmd:: set service sstp-server network-settings client-ip-settings subnet <subnet>
+
+  Use `<subnet>` as the IP pool for all connecting clients.
+
+
+.. cfgcmd:: set service sstp-server network-settings dns-server primary-dns <address>
+
+  Connected client should use `<address>` as their primary DNS server.
+
+
+.. cfgcmd:: set service sstp-server network-settings dns-server secondary-dns <address>
+
+  Connected client should use `<address>` as their secondary DNS server.
+
+SSL Certificates
+----------------
+
+.. cfgcmd:: set service sstp-server sstp-settings ssl-certs ca <file>
+
+  Path to `<file>` pointing to the certificate authority certificate.
+
+.. cfgcmd:: set service sstp-server sstp-settings ssl-certs server-cert <file>
+
+  Path to `<file>` pointing to the servers certificate (public portion).
+
+.. cfgcmd:: set service sstp-server sstp-settings ssl-certs server-key <file>
+
+  Path to `<file>` pointing to the servers certificate (private portion).
+
+PPP Settings
+------------
+
+.. cfgcmd:: set service sstp-server ppp-settings lcp-echo-failure <number>
+
+  Defines the maximum `<number>` of unanswered echo requests. Upon reaching the
+  value `<number>`, the session will be reset.
+
+.. cfgcmd:: set service sstp-server ppp-settings lcp-echo-interval <interval>
+
+  If this option is specified and is greater than 0, then the PPP module will
+  send LCP pings of the echo request every `<interval>` seconds.
+
+.. cfgcmd:: set service sstp-server ppp-settings lcp-echo-timeout
+
+  Specifies timeout in seconds to wait for any peer activity. If this option
+  specified it turns on adaptive lcp echo functionality and "lcp-echo-failure"
+  is not used.
+
+.. cfgcmd:: set service sstp-server ppp-settings mppe <require | prefer | deny>
+
+  Specifies :abbr:`MPPE (Microsoft Point-to-Point Encryption)` negotioation
+  preference.
+
+  * **require** - ask client for mppe, if it rejects drop connection
+  * **prefer** - ask client for mppe, if it rejects don't fail
+  * **deny** - deny mppe
+
+  Default behavior - don't ask client for mppe, but allow it if client wants.
+  Please note that RADIUS may override this option by MS-MPPE-Encryption-Policy
+  attribute.
+
+
+RADIUS
+------
+
+Server
+^^^^^^
+
+.. cfgcmd:: set service sstp-server authentication radius-server <server> secret <secret>
+
+  Configure RADIUS `<server>` and its required shared `<secret>` for
+  communicating with the RADIUS server.
+
+.. cfgcmd:: set service sstp-server authentication radius-server <server> secret <secret>
+
+  Configure RADIUS `<server>` and its required shared `<secret>` for
+  communicating with the RADIUS server.
+
+.. cfgcmd:: set service sstp-server authentication radius-server <server> fail-time <time>
+
+  Mark RADIUS server as offline for this given `<time>` in seconds.
+
+.. cfgcmd:: set service sstp-server authentication radius-server <server> req-limit <limit>
+
+  Maximum number of simultaneous requests to RADIUS server, default is
+  unlimited.
+
+Options
+^^^^^^^
+
+.. cfgcmd:: set service sstp-server authentication radius-settings acct-timeout
+
+  Timeout to wait reply for Interim-Update packets. (default 3 seconds)
+
+
+.. cfgcmd:: set service sstp-server authentication radius-settings dae-server ip-address <address>
+
+  Specifies IP address for Dynamic Authorization Extension server (DM/CoA)
+
+
+.. cfgcmd:: set service sstp-server authentication radius-settings dae-server port <port>
+
+  Port for Dynamic Authorization Extension server (DM/CoA)
+
+
+.. cfgcmd:: set service sstp-server authentication radius-settings dae-server secret <secret>
+
+  Secret for Dynamic Authorization Extension server (DM/CoA)
+
+
+.. cfgcmd:: set service sstp-server authentication radius-settings max-try <number>
+
+  Maximum number of tries to send Access-Request/Accounting-Request queries
+
+
+.. cfgcmd:: set service sstp-server authentication radius-settings timeout <timeout>
+
+  Timeout to wait response from server (seconds)
+
+
+.. cfgcmd:: set service sstp-server authentication radius-settings nas-identifier <identifier>
+
+  Value to send to RADIUS server in NAS-Identifier attribute and to be matched
+  in DM/CoA requests.
+
+
+.. cfgcmd:: set service sstp-server authentication radius-settings nas-ip-address <address>
+
+  Value to send to RADIUS server in NAS-IP-Address attribute and to be matched
+  in DM/CoA requests. Also DM/CoA server will bind to that address.
+
+
+.. cfgcmd:: set service sstp-server authentication radius-settings rate-limit attribute <attribute>
+
+  Specifies which RADIUS server attribute contains the rate limit information.
+  The default attribute is `Filter-Id`.
+
+
+.. cfgcmd:: set service sstp-server authentication radius-settings rate-limit enable
+
+  Enables bandwidth shaping via RADIUS.
+
+
+.. cfgcmd:: set service sstp-server authentication radius-settings rate-limit vendor
+
+  Specifies the vendor dictionary, dictionary needs to be in
+  /usr/share/accel-ppp/radius.
+
+
+
+Example
+=======
+
+* Use local user `foo` with password `bar`
+* Client IP addresses will be provided from pool `192.0.2.0/24`
 
 Use <tab> to setup the ``set sstp-settings ssl-certs ...``, it automatically
 looks for all files and directories in ``/config/user-data/sstp``.
 
 .. code-block:: none
 
-  edit service sstp-server
-  set authentication local-users username foo password 'bar'
-  set authentication mode 'local'
-  set network-settings client-ip-settings gateway-address '10.100.100.1'
-  set network-settings client-ip-settings subnet '192.168.0.0/24'
-  set network-settings dns-server primary-dns '10.100.100.1'
-  set network-settings dns-server secondary-dns '10.200.100.1'
-  set sstp-settings ssl-certs ca 'ca.crt'
-  set sstp-settings ssl-certs server-cert 'server.crt'
-  set sstp-settings ssl-certs server-key 'server.key'
+  set service sstp-server authentication local-users username foo password 'bar'
+  set service sstp-server authentication mode 'local'
+  set service sstp-server network-settings client-ip-settings gateway-address '192.0.2.0'
+  set service sstp-server network-settings client-ip-settings subnet '192.0.2.0/24'
+  set service sstp-server network-settings dns-server primary-dns '10.100.100.1'
+  set service sstp-server network-settings dns-server secondary-dns '10.200.100.1'
+  set service sstp-server sstp-settings ssl-certs ca 'ca.crt'
+  set service sstp-server sstp-settings ssl-certs server-cert 'server.crt'
+  set service sstp-server sstp-settings ssl-certs server-key 'server.key'
 
 .. include:: ../common-references.rst
diff --git a/docs/system/user-management.rst b/docs/system/user-management.rst
index c56a22a1..e1828a3d 100644
--- a/docs/system/user-management.rst
+++ b/docs/system/user-management.rst
@@ -6,8 +6,7 @@ User Management
 
 The default VyOS user account (`vyos`), as well as newly created user accounts,
 have all capabilities to configure the system. All accounts have sudo
-capabilities and therefore can operate as root on the system. Setting the level
-to `admin` is optional, all accounts on the system will have admin privileges.
+capabilities and therefore can operate as root on the system.
 
 Both local administered and remote administered :abbr:`RADIUS (Remote
 Authentication Dial-In User Service)` accounts are supported.
@@ -31,10 +30,6 @@ Local
    Setup encrypted password for given username. This is useful for
    transferring a hashed password from system to system.
 
-.. cfgcmd:: set system login user <name> group <group>
-
-   Specify additional group membership for given username `<name>`.
-
 .. _ssh_key_based_authentication:
 
 Key Based Authentication
diff --git a/docs/troubleshooting.rst b/docs/troubleshooting.rst
index baaa7452..e965a8c9 100644
--- a/docs/troubleshooting.rst
+++ b/docs/troubleshooting.rst
@@ -124,9 +124,8 @@ VyOS features several monitoring tools.
 Traffic Dumps
 ^^^^^^^^^^^^^
 
-To monitor interface traffic, issue the :code:`monitor traffic interface <type> <name>`
-command, replacing `<type>` and `<name>` with your desired interface
-type and name, respectively.
+To monitor interface traffic, issue the :code:`monitor traffic interface <name>`
+command, replacing `<name>` with your chosen interface.
 
 .. code-block:: none