vyos-1x.git/data/templates/ssh, branch 1.4.0

ssh: T6192: allow binding to multiple VRF instances

2024-04-02T16:33:59+00:00

Currently VyOS only supports binding a service to one individual VRF. It might become handy to have the services (initially it will be VRF, NTP and SNMP) be bound to multiple VRFs. Changed VRF from leafNode to multi leafNode with defaultValue: default - which is the name of the default VRF. (cherry picked from commit e5af1f0905991103b12302892e6f0070bbb7b770)

T5474: establish common file name pattern for XML conf mode commands

2024-01-01T08:25:32+00:00

We will use _ as CLI level divider. The XML definition filename and also the Python helper should match the CLI node. Example: set interfaces ethernet -> interfaces_ethernet.xml.in set interfaces bond -> interfaces_bond.xml.in set service dhcp-server -> service_dhcp-server-xml.in (cherry picked from commit 4ef110fd2c501b718344c72d495ad7e16d2bd465)

login: T4943: Fixed 2FA + RADIUS compatibility

2023-02-24T18:07:18+00:00

MFA requires KbdInteractiveAuthentication to ask a second factor, and the RADIUS module for PAM does not like it, which makes them incompatible. This commit: * disables KbdInteractiveAuthentication * changes order for PAM modules - make it first, before `pam_unix` or `pam_radius_auth` * enables the `forward_pass` option for `pam_google_authenticator` to accept both password and MFA in a single input As a result, local, RADIUS, and MFA work together. Important change: MFA should be entered together with a password. Before: ``` vyos login: Password: Verification code: ``` Now: ``` vyos login: Password & verification code: ```

ssh: T4720: Ability to configure SSH-server HostKeyAlgorithms

2022-10-17T12:15:22+00:00

Ability to configure SSH-server HostKeyAlgorithms. Specifies the host key signature algorithms that the server offers. Can accept multiple values.

Merge pull request #1555 from goodNETnick/ssh_otp

2022-10-12T07:02:37+00:00

system login: T874: add 2FA support for local and ssh authentication

2022-10-11T23:56:45+00:00

ssh: T4716: Ablity to configure RekeyLimit data and time

2022-10-10T12:52:54+00:00

Ability to configure SSH RekeyLimit data (in Megabytes) and time (in Minutes) set service ssh rekey data 1024 set service ssh rekey time 60

ssh: T3212: do not load systemd EnvironmentFile

2022-07-22T21:16:13+00:00

sshguard: T4408: rename whitelist-address -> allow-from

2022-05-13T16:43:09+00:00

We do not only allow individual host addresses but also prefixes.

sshguard: T4408: Add service ssh dynamic-protection

2022-05-12T17:27:38+00:00

Sshguard protects hosts from brute-force attacks Can inspect logs and block "bad" addresses by threshold Auto-generate rules for nftables When service stopped all generated rules are deleted nft "type filter hook input priority filter - 10" set service ssh dynamic-protection set service ssh dynamic-protection block-time 120 set service ssh dynamic-protection detect-time 1800 set service ssh dynamic-protection threshold 30 set service ssh dynamic-protection whitelist-address 192.0.2.1