1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
|
---
lastproofread: '2026-03-16'
---
(command-scripting)=
# Command scripting
VyOS supports executing configuration and operational commands non-interactively
from shell scripts.
To include VyOS-specific functions and aliases, source the
`/opt/vyatta/etc/functions/script-template` file at the beginning of your
script.
```none
#!/bin/vbash
source /opt/vyatta/etc/functions/script-template
exit
```
## Script execute permissions
Simply placing script files in `/config/scripts/` does not mean the system
can execute them.
To make your scripts executable, grant them **execute permissions**. Use the
following command:
```none
chmod +x /config/scripts/script-name.sh
```
## Run configuration commands
In scripts, present configuration commands as in a standard configuration
session.
For example, to disable a BGP peer during a VRRP transition to the backup
state, use the following syntax:
```none
#!/bin/vbash
source /opt/vyatta/etc/functions/script-template
configure
set protocols bgp system-as 65536
set protocols bgp neighbor 192.168.2.1 shutdown
commit
exit
```
## Run operational commands
In scripts, **always** prefix operational commands with `run`.
```none
#!/bin/vbash
source /opt/vyatta/etc/functions/script-template
run show interfaces
exit
```
## Run commands remotely
You can execute multiple **operational commands** on a remote VyOS system by
passing a script block over SSH.
```none
ssh 192.0.2.1 'vbash -s' <<EOF
source /opt/vyatta/etc/functions/script-template
run show interfaces
exit
EOF
```
Example output:
```none
Welcome to VyOS
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
--------- ---------- --- -----------
eth0 192.0.2.1/24 u/u
lo 127.0.0.1/8 u/u
::1/128
```
## Other script languages
If you use a scripting language other than bash, configure your script to
output the relevant commands, and then source that output into a bash script.
The following example demonstrates this two-step process:
```python
#!/usr/bin/env python3
print("delete firewall group address-group somehosts")
print("set firewall group address-group somehosts address '192.0.2.3'")
print("set firewall group address-group somehosts address '203.0.113.55'")
```
```none
#!/bin/vbash
source /opt/vyatta/etc/functions/script-template
configure
source <(/config/scripts/setfirewallgroup.py)
commit
```
## Execute configuration scripts
In Linux, it is common practice to prefix system commands with `sudo`.
In VyOS, if you prefix a script that modifies the configuration with `sudo`
(see the code snippet below), subsequent manual configuration changes fail with
the `Set failed` error. Recovery requires a system reboot.
```none
sudo ./myscript.sh # Modifies config
configure
set ... # Any configuration parameter
```
To avoid this issue, run scripts under the `vyattacfg` group using the `sg`
command:
```none
sg vyattacfg -c ./myscript.sh
```
To ensure the script is executed under the `vyattacfg` group, safeguard it as
follows:
```none
if [ "$(id -g -n)" != 'vyattacfg' ] ; then
exec sg vyattacfg -c "/bin/vbash $(readlink -f $0) $@"
fi
```
## Executing pre-hooks/post-hooks scripts
VyOS allows you to run custom scripts **before** and **after** each commit.
Place your custom scripts in the following default directories:
```none
/config/scripts/commit/pre-hooks.d - Directory with scripts that run before
each commit.
/config/scripts/commit/post-hooks.d - Directory with scripts that run after
each commit.
```
Scripts run in alphabetical order. Filenames must consist only of ASCII letters
(upper and lowercase), digits (0-9), underscores (\_), and hyphens (-). No other
characters are allowed.
:::{note}
Custom scripts are executed **without** root privileges. Prefix
specific commands with `sudo` in your script when required.
:::
The following example shows the output after executing a post-hook script
that runs the `show interfaces` command:
```none
vyos@vyos# set interfaces ethernet eth1 address 192.0.2.3/24
vyos@vyos# commit
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
--------- ---------- --- -----------
eth0 198.51.100.10/24 u/u
eth1 192.0.2.3/24 u/u
eth2 - u/u
eth3 - u/u
lo 203.0.113.5/24 u/u
```
## Preconfig script on boot
VyOS runs `/config/scripts/vyos-preconfig-bootup.script` at boot, **before**
the system configuration is applied.
Use this script to apply **pre-configuration** workarounds for unresolved bugs
or enhancements not yet available in VyOS.
The default script contains the following:
```none
#!/bin/sh
# This script is executed at boot time before VyOS configuration is applied.
# Any modifications required to work around unfixed bugs or use
# services not available through the VyOS CLI system can be placed here.
```
## Postconfig script on boot
VyOS runs `/config/scripts/vyos-postconfig-bootup.script` at boot, **after**
the system configuration is applied.
Use this script to apply **post-configuration** workarounds for unresolved bugs
or enhancements not yet available in VyOS.
The default script contains the following:
```none
#!/bin/sh
# This script is executed at boot time after VyOS configuration is fully
# applied. Any modifications required to work around unfixed bugs or use
# services not available through the VyOS CLI system can be placed here.
```
:::{warning}
For configuration or upgrade management issues, modify this script
only as a last resort. Always try CLI-based solutions first.
:::
|
