Page MenuHomeVyOS Platform

HTTP-API: per-key command restrictions
Open, WishlistPublicFEATURE REQUEST

Description

It would be ideal if we could restrict the commands that a specific API key has access to.

Similar to TACACS command authorization, the addition of this feature would allow us to harden the API and the router.

E.g., limit a given API key to only show commands, or even specific configuration commands.

Possible configuration syntax:

# limit key to show commands only
set service https api keys id MY-HTTPS-API-ID key MY-HTTPS-API-PLAINTEXT-KEY
set service https api keys id MY-HTTPS-API-ID endpoint show op show
# limit key to specific set/delete config commands
set service https api keys id MY-HTTPS-API-ID key MY-HTTPS-API-PLAINTEXT-KEY
set service https api keys id MY-HTTPS-API-ID endpoint configure op delete path protocols bgp neighbor * description *
set service https api keys id MY-HTTPS-API-ID endpoint configure op delete path protocols bgp neighbor * shutdown
set service https api keys id MY-HTTPS-API-ID endpoint configure op set path protocols bgp neighbor * description *
set service https api keys id MY-HTTPS-API-ID endpoint configure op set path protocols bgp neighbor * shutdown

Details

Version
1.4
Is it a breaking change?
Perfectly compatible
Issue type
Feature (new functionality)

Event Timeline

etedor triaged this task as Wishlist priority.
etedor created this object in space S1 VyOS Public.

Not sure that it is a good idea for this format.
The syntax between versions (1.3/1.4 bgd/isisd) is changed. With every syntax change you should also change and section "service https API ... bgp"
My point API must have a full access to all configuration options.

dmbaturin set Issue type to Unspecified (please specify).
dmbaturin added a subscriber: jestabro.
dmbaturin changed Is it a breaking change? from Unspecified (possibly destroys the router) to Perfectly compatible.
dmbaturin changed Issue type from Unspecified (please specify) to Feature (new functionality).
syncer changed the subtype of this task from "Task" to "Feature Request".Oct 30 2024, 8:28 AM
syncer removed a project: VyOS 1.5 Circinus.
syncer moved this task from Need Triage to Backlog - Feature Requests on the VyOS Rolling board.