vyos-1x.git/data/templates/ssh, branch 1.4.0-rc2

T5474: establish common file name pattern for XML conf mode commands

2024-01-01T08:25:32+00:00

We will use _ as CLI level divider. The XML definition filename and also the Python helper should match the CLI node. Example: set interfaces ethernet -> interfaces_ethernet.xml.in set interfaces bond -> interfaces_bond.xml.in set service dhcp-server -> service_dhcp-server-xml.in (cherry picked from commit 4ef110fd2c501b718344c72d495ad7e16d2bd465)

login: T4943: Fixed 2FA + RADIUS compatibility

2023-02-24T18:07:18+00:00

MFA requires KbdInteractiveAuthentication to ask a second factor, and the RADIUS module for PAM does not like it, which makes them incompatible. This commit: * disables KbdInteractiveAuthentication * changes order for PAM modules - make it first, before `pam_unix` or `pam_radius_auth` * enables the `forward_pass` option for `pam_google_authenticator` to accept both password and MFA in a single input As a result, local, RADIUS, and MFA work together. Important change: MFA should be entered together with a password. Before: ``` vyos login: Password: Verification code: ``` Now: ``` vyos login: Password & verification code: ```

ssh: T4720: Ability to configure SSH-server HostKeyAlgorithms

2022-10-17T12:15:22+00:00

Ability to configure SSH-server HostKeyAlgorithms. Specifies the host key signature algorithms that the server offers. Can accept multiple values.

Merge pull request #1555 from goodNETnick/ssh_otp

2022-10-12T07:02:37+00:00

system login: T874: add 2FA support for local and ssh authentication

2022-10-11T23:56:45+00:00

ssh: T4716: Ablity to configure RekeyLimit data and time

2022-10-10T12:52:54+00:00

Ability to configure SSH RekeyLimit data (in Megabytes) and time (in Minutes) set service ssh rekey data 1024 set service ssh rekey time 60

ssh: T3212: do not load systemd EnvironmentFile

2022-07-22T21:16:13+00:00

sshguard: T4408: rename whitelist-address -> allow-from

2022-05-13T16:43:09+00:00

We do not only allow individual host addresses but also prefixes.

sshguard: T4408: Add service ssh dynamic-protection

2022-05-12T17:27:38+00:00

Sshguard protects hosts from brute-force attacks Can inspect logs and block "bad" addresses by threshold Auto-generate rules for nftables When service stopped all generated rules are deleted nft "type filter hook input priority filter - 10" set service ssh dynamic-protection set service ssh dynamic-protection block-time 120 set service ssh dynamic-protection detect-time 1800 set service ssh dynamic-protection threshold 30 set service ssh dynamic-protection whitelist-address 192.0.2.1

ssh: T4353: fix Jinja2 linting errors

2022-04-14T19:34:52+00:00