blob: 5588e43438812185dfec5bde1badcc57cb02ad56 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
|
.. _systemusers:
System Users
------------
The default vyos user account, as well as newly created user accounts, have all
capabilities to configure the system. All accounts have sudo capabilities and
therefore can operate as root on the system. Setting the level to admin is
optional, all accounts on the system will have admin privileges.
Creating Login User Accounts
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Create user account `jsmith` and the password `mypassword`.
.. code-block:: sh
set system login user jsmith full-name "Johan Smith"
set system login user jsmith authentication plaintext-password mypassword
The command:
.. code-block:: sh
show system login
will show the contents of :code:`system login` configuration node:
.. code-block:: sh
user jsmith {
authentication {
encrypted-password $6$0OQHjuQ8M$AYXVn7jufdfqPrSk4/XXsDBw99JBtNsETkQKDgVLptXogHA2bU9BWlvViOFPBoFxIi.iqjqrvsQdQ./cfiiPT.
plaintext-password ""
}
full-name "Johan Smith"
level admin
}
SSH Access using Shared Public Keys
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
The following command will load the public key `dev.pub` for user `jsmith`
.. code-block:: sh
loadkey jsmith dev.pub
.. note:: This requires uploading the `dev.pub` public key to the VyOS router
first. As an alternative you can also load the SSH public key directly
from a remote system:
.. code-block:: sh
loadkey jsmith scp://devuser@dev001.vyos.net/home/devuser/.ssh/dev.pub
RADIUS authentication backend
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
VyOS supports using one or more RADIUS servers as backend for user authentication.
The following command sets up two servers for RADIUS authentication, one with a
discrete timeout of `5` seconds and a discrete port of `1812` and the other using
a default timeout and port.
.. code-block:: sh
set system login radius server 192.168.1.2 secret 's3cr3t0815'
set system login radius server 192.168.1.2 timeout '5'
set system login radius server 192.168.1.2 port '1812'
set system login radius server 192.168.1.3 secret 's3cr3t0816'
This configuration results in:
.. code-block:: sh
show system login radius
server 192.168.1.2 {
secret s3cr3t0815
timeout 5
port 1812
}
server 192.168.1.3 {
secret s3cr3t0816
}
RADIUS Source Address
*********************
If you are using e.g. OSPF as IGP always the nearest interface facing the RADIUS
server is used. With VyOS 1.2 you can bind all outgoing RADIUS requests to a
single source IP e.g. the loopback interface.
.. code-block:: sh
set system login radius source-address 3.3.3.3
Above command will use `3.3.3.3` as source IPv4 address for all queries originating
from this NAS.
|
