Page MenuHomeVyOS Platform
Files F118309225

vyos-config-ssh.py
No OneTemporary
Actions

Size
6 KB
Referenced Files
None
Subscribers
None

vyos-config-ssh.py
View Options

#!/usr/bin/env python3
#
# Copyright (C) 2018 VyOS maintainers and contributors
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2 or later as
# published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
#
import sys
import os
import time
from vyos.config import Config
from vyos.util import ConfigError
config_file = r'/etc/ssh/sshd_config'
def get_config():
ssh = {}
conf = Config()
conf.set_level('service ssh')
if not conf.exists(''):
return ssh
if conf.exists('access-control allow'):
ssh.setdefault('allowed-users', [])
allow_user = []
allow_user = conf.return_values('access-control allow user')
for user in allow_user:
ssh['allowed-users'].append(user)
ssh.setdefault('allowed-groups', [])
allow_group = []
allow_group = conf.return_values('access-control allow group')
for group in allow_group:
ssh['allowed-groups'].append(group)
if conf.exists('access-control deny'):
ssh.setdefault('deny-users', [])
deny_user = []
deny_user = conf.return_values('access-control deny user')
for user in deny_user:
ssh['deny-users'].append(user)
ssh.setdefault('deny-groups', [])
deny_group = []
deny_group = conf.return_values('access-control deny group')
for group in deny_group:
ssh['deny-groups'].append(group)
if conf.exists('allow-root'):
ssh.setdefault('allow-root', True)
if conf.exists('ciphers'):
ciphers = conf.return_value('ciphers')
ssh.setdefault('ciphers', ciphers)
if conf.exists('disable-host-validation'):
ssh.setdefault('disable-host-validation', True)
if conf.exists('disable-password-authentication'):
ssh.setdefault('disable-password-authentication', True)
if conf.exists('key-exchange'):
kex = conf.return_value('key-exchange')
ssh.setdefault('key-exchange', kex)
if conf.exists('listen-address'):
ssh.setdefault('listen-address', [])
addresses = []
addresses = conf.return_values('listen-address')
for addr in addresses:
ssh['listen-address'].append(addr)
if conf.exists('loglevel'):
level = conf.return_value('loglevel')
ssh.setdefault('loglevel', level)
if conf.exists('mac'):
mac = conf.return_value('mac')
ssh.setdefault('mac', mac)
if conf.exists('port'):
port = conf.return_value('port')
ssh.setdefault('port', port)
print(ssh)
return ssh
def verify(ssh):
return None
def generate(ssh):
config_header = '### Autogenerated by vyos-config-ssh.py on {tm} ###\n'.format(tm=time.strftime("%a, %d %b %Y %H:%M:%S", time.localtime()))
# write new configuration file
f = open(config_file, 'w')
f.write(config_header)
f.write('\n')
if 'port' in ssh.keys():
f.write('Port {0}\n'.format(ssh['port']))
else:
f.write('Port 22\n')
f.write('Protocol 2\n')
f.write('HostKey /etc/ssh/ssh_host_rsa_key\n')
f.write('HostKey /etc/ssh/ssh_host_dsa_key\n')
f.write('HostKey /etc/ssh/ssh_host_ecdsa_key\n')
f.write('HostKey /etc/ssh/ssh_host_ed25519_key\n')
f.write('UsePrivilegeSeparation yes\n')
f.write('\n')
f.write('KeyRegenerationInterval 3600\n')
f.write('ServerKeyBits 1024\n')
f.write('\n')
f.write('SyslogFacility AUTH\n')
if 'loglevel' in ssh.keys():
f.write('LogLevel {0}\n'.format(ssh['loglevel']))
else:
f.write('LogLevel INFO\n')
f.write('\n')
f.write('LoginGraceTime 120\n')
if 'allow-root' in ssh.keys():
f.write('PermitRootLogin yes\n')
else:
f.write('PermitRootLogin no\n')
f.write('StrictModes yes\n')
f.write('\n')
f.write('RSAAuthentication yes\n')
f.write('PubkeyAuthentication yes\n')
f.write('\n')
f.write('IgnoreRhosts yes\n')
f.write('RhostsRSAAuthentication no\n')
f.write('HostbasedAuthentication no\n')
f.write('\n')
f.write('PermitEmptyPasswords no\n')
f.write('\n')
f.write('ChallengeResponseAuthentication no\n')
f.write('\n')
if 'disable-password-authentication' in ssh.keys():
f.write('PasswordAuthentication no\n')
else:
f.write('PasswordAuthentication yes\n')
f.write('\n')
f.write('X11Forwarding yes\n')
f.write('X11DisplayOffset 10\n')
f.write('PrintMotd no\n')
f.write('PrintLastLog yes\n')
f.write('TCPKeepAlive yes\n')
f.write('\n')
f.write('Banner /etc/issue.net\n')
f.write('\n')
f.write('Subsystem sftp /usr/lib/openssh/sftp-server\n')
f.write('\n')
f.write('UsePAM yes\n')
f.write('HostKey /etc/ssh/ssh_host_key\n')
if 'disable-host-validation' in ssh.keys():
f.write('UseDNS no\n')
else:
f.write('UseDNS yes\n')
if 'listen-address' in ssh.keys():
for addr in ssh['listen-address']:
f.write('ListenAddress {0}\n'.format(addr))
if 'ciphers' in ssh.keys():
f.write('Ciphers {0}\n'.format(ssh['ciphers']))
if 'key-exchange' in ssh.keys():
f.write('KexAlgorithms {0}\n'.format(ssh['key-exchange']))
if 'mac' in ssh.keys():
f.write('MACs {0}\n'.format(ssh['mac']))
if 'allowed-users' in ssh.keys():
print('AllowUsers {0}\n'.format(' '.join(str(usr) for usr in ssh['allowed-users'])))
if 'allowed-groups' in ssh.keys():
print('AllowGroups {0}\n'.format(' '.join(str(grp) for grp in ssh['allowed-groups'])))
if 'deny-users' in ssh.keys():
print('DenyUsers {0}\n'.format(' '.join(str(usr) for usr in ssh['deny-users'])))
if 'deny-groups' in ssh.keys():
print('DenyGroups {0}\n'.format(' '.join(str(grp) for grp in ssh['deny-groups'])))
f.close()
return None
def apply(ssh):
if 'port' in ssh.keys():
cmd = "sudo systemctl restart ssh"
else:
cmd = "sudo systemctl stop ssh"
os.system(cmd)
return None
if __name__ == '__main__':
try:
c = get_config()
verify(c)
generate(c)
apply(c)
except ConfigError as e:
print(e)
sys.exit(1)

File Metadata

Mime Type
text/x-script.python
Expires
Sat, Oct 17, 12:45 AM (9 h, 34 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
4350684
Default Alt Text
vyos-config-ssh.py (6 KB)

Event Timeline