blob: 9965dd69ef37199f79f820fdf5d56fffb2e43953 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
|
<?xml version="1.0"?>
<!--SSH configuration -->
<interfaceDefinition>
<node name="service">
<children>
<node name="ssh" owner="${vyos_sbindir}/vyos-config-ssh.py">
<properties>
<help>Secure SHell (SSH) protocol</help>
<priority>500</priority>
</properties>
<children>
<node name="access-control">
<properties>
<help>SSH user/group access controls</help>
</properties>
<children>
<leafNode name="allow-groups">
<properties>
<help>Configure sshd_config access control for allowed groups</help>
</properties>
</leafNode>
<leafNode name="allow-users">
<properties>
<help>Configure sshd_config access control for allowed users</help>
</properties>
</leafNode>
<leafNode name="deny-groups">
<properties>
<help>Configure sshd_config access control for disallowed groups</help>
</properties>
</leafNode>
<leafNode name="deny-users">
<properties>
<help>Configure sshd_config access control for disallowed users</help>
</properties>
</leafNode>
</children>
</node>
<leafNode name="allow-root">
<properties>
<help>Enable root login over ssh</help>
</properties>
</leafNode>
<leafNode name="ciphers">
<properties>
<help>Allowed ciphers</help>
<valueHelp>
<format>chacha20-poly1305@openssh.com</format>
<description>ChaCha20 Poly1305</description>
</valueHelp>
<valueHelp>
<format>3des-cbc</format>
<description>3DES CBC (weak)</description>
</valueHelp>
<valueHelp>
<format>aes128-cbc</format>
<description>AES 128 CBC</description>
</valueHelp>
<valueHelp>
<format>aes192-cbc</format>
<description>AES 192 CBC</description>
</valueHelp>
<valueHelp>
<format>aes256-cbc</format>
<description>AES 256 CBC</description>
</valueHelp>
<valueHelp>
<format>aes128-ctr</format>
<description>AES 128 CTR</description>
</valueHelp>
<valueHelp>
<format>aes192-ctr</format>
<description>AES 192 CTR</description>
</valueHelp>
<valueHelp>
<format>aes256-ctr</format>
<description>AES 256 CTR</description>
</valueHelp>
<valueHelp>
<format>arcfour128</format>
<description>AC4 128 (broken)</description>
</valueHelp>
<valueHelp>
<format>arcfour256</format>
<description>AC4 256 (broken)</description>
</valueHelp>
<valueHelp>
<format>arcfour</format>
<description>AC4 (broken)</description>
</valueHelp>
<valueHelp>
<format>blowfish-cbc</format>
<description>Blowfish CBC</description>
</valueHelp>
<valueHelp>
<format>cast128-cbc</format>
<description>CAST 128 CBC</description>
</valueHelp>
</properties>
</leafNode>
<leafNode name="disable-host-validation">
<properties>
<help>Don't validate the remote host name with DNS</help>
</properties>
</leafNode>
<leafNode name="disable-password-authentication">
<properties>
<help>Don't allow unknown user to login with password</help>
</properties>
</leafNode>
<leafNode name="key-exchange">
<properties>
<help>Key exchange algorithms</help>
<completionHelp>
<script>ssh -Q kex | perl -ne '$_=~s/\n/ /;print'</script>
</completionHelp>
</properties>
</leafNode>
<leafNode name="listen-address">
<properties>
<help>Local addresses SSH service should listen on</help>
<valueHelp>
<format>ipv4</format>
<description>IP address to listen for incoming connections</description>
</valueHelp>
<valueHelp>
<format>ipv6</format>
<description>IPv6 address to listen for incoming connections</description>
</valueHelp>
<type>ipv4,ipv6</type>
<multi/>
</properties>
</leafNode>
<leafNode name="loglevel">
<properties>
<help>Log level</help>
<valueHelp>
<format>QUIET</format>
<description>stay silent</description>
</valueHelp>
<valueHelp>
<format>FATAL</format>
<description>log fatals only</description>
</valueHelp>
<valueHelp>
<format>ERROR</format>
<description>log errors and fatals only</description>
</valueHelp>
<valueHelp>
<format>INFO</format>
<description>default log level</description>
</valueHelp>
<valueHelp>
<format>VERBOSE</format>
<description>enable logging of failed login attempts</description>
</valueHelp>
</properties>
</leafNode>
<leafNode name="mac">
<properties>
<help>Allowed message authentication algorithms</help>
<completionHelp>
<script>ssh -Q mac | perl -ne '$_=~s/\n/ /;print'</script>
</completionHelp>
</properties>
</leafNode>
<leafNode name="port">
<properties>
<help>Port for SSH service</help>
<valueHelp>
<format>u32:1-65535</format>
<description>Numeric IP port</description>
</valueHelp>
<type>u32</type>
</properties>
</leafNode>
</children>
</node>
</children>
</node>
</interfaceDefinition>
|
