vyos-1x.git/data/templates/login, branch feature/T9082-codeql-cpp

ci: T8490: fix typos in comments, strings, and local identifiers

2026-06-29T12:10:10+00:00

Reaches a clean typos baseline for the T8490 ruleset pilot. Categories: - Comments/docs: recursivly, taret, passsed, characted, arhive, AtrributeError; "ned" -> "new" (migration comments). - Messages/strings: writeable -> writable (x5); OCaml log "Commandis" -> "Command is". - Local variables (all refs in-function): commited, formating, presistent; inpt_range -> input_range; tz_datas -> tz_data_raw (avoids the tz_data collision). - Self-contained renames (definition + all references in-file): formated_stats, _get_formatted_output_conections -> ..._connections, expension_failure -> expansion_failure (ping + traceroute), snmpd_restart_reqired -> ..._required. False positives are allowlisted centrally (vyos/.github, separate PR), NOT changed here: mke2fs, Maya-calendar "Mak", RFC 4122 "IDentifier" (hostapd), and VPP's "U-Forwrd" bridge-domain column header (op_mode/vpp.py + the VPP smoketest assert the real upstream `vppctl` output). Verified: typos clean, py_compile of every edited .py, zero remaining old-identifier references. 🤖 Generated by [robots](https://vyos.io)

T8410: Fix typos and mistakes for operational and configuration commands

2026-03-24T17:02:56+00:00

Fix typos and mistakes in the commands and comments No functional changes

ssh: T7839: add deprecation warning for DSA hostkey-algorithm usage

2025-09-17T19:49:34+00:00

OpenSSH in Debian Trixie has removed support for ssh-dss (DSA) keys, which will prevent users with such keys from logging in after upgrade. To avoid lockouts, add a loud deprecation warning when users log in using a DSA key. This warning advises affected users to replace their keys with a supported algorithm (e.g., ed25519 or RSA) before the upgrade. Deprecation warning will be displayed during "commit" but also as MOTD to inform on this issue during every login. DEPRECATION WARNING: Support for SSH-DSA keys is deprecated and will be removed in VyOS 1.6. Please update affected keys to a supported algorithm (e.g., RSA, ECDSA or ED25519) to avoid authentication failures after the upgrade. The following hostkey-algorithms are in use: ssh-dss, ssh-dss-cert-v01@openssh.com

login: T7839: add deprecation warning for DSS public-key usage

2025-09-17T19:16:49+00:00

OpenSSH in Debian Trixie has removed support for ssh-dss (DSA) keys, which will prevent users with such keys from logging in after upgrade. To avoid lockouts, add a loud deprecation warning when users log in using a DSA key. This warning advises affected users to replace their keys with a supported algorithm (e.g., ed25519 or RSA) before the upgrade. Deprecation warning will be displayed during "commit" but also as MOTD to inform on this issue during every login. DEPRECATION WARNING: Support for SSH-DSA keys is deprecated and will be removed in VyOS 1.6. Please update affected keys to a supported algorithm (e.g., RSA, ECDSA or ED25519) to avoid authentication failures after the upgrade. The following users are using SSH-DSS keys for authentication. User "vyos" with deprecated public-key named: foo

ssh: T6013: move principal name to "system login user authentication"

2025-05-29T11:57:48+00:00

We already support using per-user SSH public keys for system authentication. Instead of introducing a new CLI path to configure per-user principal names, we should continue using the existing CLI location and store the principal names alongside the corresponding SSH public keys. set system login user principal The certificate used for SSH authentication contains an embedded principal name, which is defined under this CLI node. Only users with matching principal names are permitted to log in.

login: T6712: add newline after motd warning message

2025-03-07T18:30:18+00:00

radius: T7039: fix broken IPv6 source address

2025-01-11T09:59:23+00:00

When configuring RADIUS to use IPv6 as connection to the server with an optional source-address set system login radius server 2001:db8::4 key '9LMVCtPYpG' set system login radius source-address '2001:db8::1' It will error out: pam_radius_auth(sshd:auth): Failed looking up source IP address [2001:db8::1] for server [2001:db8::4]:1812 (error=System error) The source address is not allowed to be in [] - thus the brackets need to be removed.

tacacs: T6613: dynamically build exclude_users list to avoid TACACS traffic

2024-12-15T10:03:26+00:00

There is no need to send local base OS accounts like root or daemon to the tacacs server. This will only make the CLI experience sluggish. Build up a dynamic list of user accounts to exclude from TACACS lookup.

login: T6712: honor 80x25 terminal size for nonproduction banner message

2024-10-27T18:42:27+00:00

T6712: Add nonproduction banner (#4149)

2024-10-11T05:23:46+00:00

(cherry picked from commit 3abe7c72c95c3d9b825db08b092c555786e9fbcf) Co-authored-by: Viacheslav Hletenko