vyos-1x.git/src/migration-scripts/ssh, branch rolling

ssh: T8098: migrate "rijndael-cbc@lysator.liu.se" to "aes256-cbc" cipher

2025-12-17T10:37:48+00:00

According to [1] rijndael-cbc@lysator.liu.se is an alias for aes256-cbc which was standardized in RFC4253 (2006). This changes the migrator implementation to not only delete the old "rijndael-cbc@lysator.liu.se" cipher from the CLI and set the new, standardized aes256-cbc SSH cipher. 1: https://github.com/openssh/openssh-portable/commit/03e93c753d7c223063a

ssh: T8098: rename "ciphers" CLI node to "cipher"

2025-12-14T17:58:00+00:00

Follow VyOS CLI best practices for using singular whenever possible to build a CLI node. As we introduce a new migration 2 -> 3 for SSH we can correct this minor detail.

ssh: T8098: remove support for deprecated "rijndael-cbc@lysator.liu.se" cipher

2025-12-14T17:41:08+00:00

According to an Arch Linux forum discussion, the cipher rijndael-cbc@lysator.liu.se was removed in OpenSSH 6.7. References: - https://bbs.archlinux.org/viewtopic.php?id=188613 - https://www.openssh.org/txt/release-6.7 - https://github.com/openssh/openssh-portable/commit/03e93c753d7c223063a

T7591: remove copyright years from source files

2025-06-28T21:16:52+00:00

The legal team says years are not necessary so we can go ahead with it, since it will simplify backporting. Automatically removed using: git ls-files | grep -v libvyosconfig | xargs sed -i -E \ 's/^# Copyright (19|20)[0-9]{2}(-[0-9]{4})? VyOS maintainers.*/# Copyright VyOS maintainers and contributors /g' In addition we will error-out during "make" if someone re-adds a legacy copyright notice

migration: T6007: convert all migration scripts to load as module

2024-06-26T20:38:41+00:00

T5427: Fix migration script arguments len expects 2 args

2023-08-02T09:12:23+00:00

The script's name is always provided as the first argument sys.argv[0] Expected length for argv is 2 (script itself + config file) Change: 'if (len(argv) < 1)' to 'if len(argv) < 2'

ssh: T4273: bugfix cipher and key-exchange multi nodes

2022-02-28T13:28:55+00:00

After hardning the regex validator to be preceeded with ^ and ending with $ it was no longer possible to have a comma separated list as SSH ciphers. The migrations cript is altered to migrate the previous comma separated list to individual multi node entries - cipher and key-exchange always had been multinodes - so this just re-arranges some values and does not break CLI compatibility

ssh: T2691: bugfix loglevel config migration

2020-07-07T17:05:00+00:00

When migrating the conf from VyOS 1.2 to 1.3 a configuration error could appear if the user specified "info" as loglevel instead of "INFO". There was no input validation done in 1.2 but this is now enforced in 1.3. In VyOS 1.3 loglevel will be always lowercase on the CLI and when migrating the config this is transformed. Also VyOS 1.2 accpeted any arbitrary loglevel. If an invalid loglevel is found it will be set to info.

T634: remove 'service ssh allow-root'

2018-10-21T18:03:13+00:00