VyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git) https://git.amelek.net/vyos/vyos-1x.git/atom?h=feature%2FT9082-codeql-cpp 2023-12-31T22:49:48+00:00 2023-12-31T22:49:48+00:00 Christian Breunig christian@breunig.cc 2023-12-30T22:25:20+00:00 urn:sha1:4ef110fd2c501b718344c72d495ad7e16d2bd465 We will use _ as CLI level divider. The XML definition filename and also the Python helper should match the CLI node. Example: set interfaces ethernet -> interfaces_ethernet.xml.in set interfaces bond -> interfaces_bond.xml.in set service dhcp-server -> service_dhcp-server-xml.in 2023-12-29T20:03:07+00:00 Christian Breunig christian@breunig.cc 2023-12-29T19:54:29+00:00 urn:sha1:3c990f49e2bf9347bd2cc478995baa995ee822fd After deleting a user account and working with a newly added account, we see that after rebooting in the previously saved configuration, the user is re-added but it's home directory might have an old UID set on the filesystem. This is due to the fact that vyos config does not store UIDs. When adding a user account to the system we now check if the home directory already exists and adjust the ownership to the new UID. 2023-12-09T20:35:50+00:00 Christian Breunig christian@breunig.cc 2023-12-09T20:35:50+00:00 urn:sha1:2778f53cc1f9f03a6c145e45082ca95ba21a1a96 dhcp: T3316: Migrate dhcp/dhcpv6 server to Kea 2023-12-08T06:46:21+00:00 Christian Breunig christian@breunig.cc 2023-12-07T20:30:57+00:00 urn:sha1:e134dc4171b051d0f98c7151ef32a347bc4f87e2 The initial version always enabled Google authenticator (2FA/MFA) support by hardcoding the PAM module for sshd and login. This change only enables the PAM module on demand if any use has 2FA/MFA configured. Enabling the module is done system wide via pam-auth-update by using a predefined template. Can be tested using: set system login user vyos authentication plaintext-password vyos set system login user vyos authentication otp key 'QY735IG5HDHBFHS5W7Y2A4EM274SMT3O' See https://docs.vyos.io/en/latest/configuration/system/login.html for additional details. 2023-12-07T23:29:38+00:00 sarthurdev 965089+sarthurdev@users.noreply.github.com 2022-12-16T10:41:33+00:00 urn:sha1:d95200e96763e4a7ed02577b1b177c84abb77838 2023-10-04T07:40:45+00:00 Christian Breunig christian@breunig.cc 2023-10-04T07:40:45+00:00 urn:sha1:53bc1627c09d7b6559aaafabfac69a7427e8e38c This reverts commit 64d323299586da646ca847e78255ff2cd8464578. 2023-10-03T07:33:16+00:00 Christian Breunig christian@breunig.cc 2023-10-03T07:26:33+00:00 urn:sha1:64d323299586da646ca847e78255ff2cd8464578 During system startup the system-login.py script is invoked by vyos-router systemd service. As there is no complete configuration available at this point in time - and the sole purpose of this call is to reset/re-render the system NSS/PAM configs back to default - it accidently also deleted the local useraccounts. Once the VyOS configuration got mounted, users got recreated in alphabetical order and thus UIDs flipped and the /home suddenely belonged to a different account. This commit prevents any mangling with the local userdatabase during VyOS bootup phase. 2023-09-13T18:02:32+00:00 zsdc taras@vyos.io 2023-09-13T10:16:20+00:00 urn:sha1:1c804685d05ad639bcb1a9ebce68a7a14268500f In CLI we can choose authentication logic: - `mandatory` - if TACACS+ answered with `REJECT`, authentication must be stopped and access denied immediately. - `optional` (default) - if TACACS+ answers with `REJECT`, authentication continues using the next module. In `mandatory` mode authentication will be stopped only if TACACS+ clearly answered that access should be denied (no user in TACACS+ database, wrong password, etc.). If TACACS+ is not available or other errors happen, it will be skipped and authentication will continue with the next module, like in `optional` mode. 2023-09-13T17:41:43+00:00 zsdc taras@vyos.io 2023-09-13T09:41:04+00:00 urn:sha1:5181ab60bb6d936505967d6667adc12c5ecb9b64 In CLI we can choose authentication logic: - `mandatory` - if RADIUS answered with `Access-Reject`, authentication must be stopped and access denied immediately. - `optional` (default) - if RADIUS answers with `Access-Reject`, authentication continues using the next module. In `mandatory` mode authentication will be stopped only if RADIUS clearly answered that access should be denied (no user in RADIUS database, wrong password, etc.). If RADIUS is not available or other errors happen, it will be skipped and authentication will continue with the next module, like in `optional` mode. 2023-08-07T19:46:42+00:00 John Estabrook jestabro@vyos.io 2023-08-07T01:38:15+00:00 urn:sha1:4b9e52aa5b9728a89715bf1f7f54063aa3e7aaef