This should be implemented under the rewrite of system-image-tools:
https://vyos.dev/T4516

This has not been seen subsequently. Close unless recurrence.

Discussed, and ready to be implemented shortly.

Related to T3651.

This will be integrated with the PKI subsystem, using the ideas there.

@fernando

1. In order to apply SSM auto-configuration of the CloudWatch agent, an SSM agent must be installed that installs the CloudWatch agent with the necessary configuration. Currently, there is no SSM agent inside VyOS AWS images, and I haven't heard anything about willingness to include it.
2. The amazon-cloudwatch-agent package has only one dependency, libc6. Therefore, it does not need the aws-cli to be configured or set up at all.
3. Granting access to the CloudWatch service from an EC2 instance is done by applying the corresponding IAM role to the instance. While it is possible to do this via manual credential input, it is an unwanted practice inside AWS.
4. The possible scenario of sending data to CloudWatch out of AWS is unique and requires another Phorge task, I think.

@unity when you need AWS credential , will they be automatically deployed from SSM or will we have to add those credentials in the virtual machine? ? shouldn't aws-cli be integrated?

This was addressed within T4364, and backported in T4874.

@Viacheslav confirmed working.

@Viacheslav Confirmed fixed, thank you.

I've created the PR https://github.com/vyos/vyos-documentation/pull/987 as a temporary explanation for users on how to preserve CloudWatch Agent configuration in a semi-automated way, using the SSM Parameter Store.

The firewall for ocserv is handled by https://gitlab.com/openconnect/ocserv/-/blob/master/src/ocserv-fw and uses iptables by default

Supporting (draft) PR and minor fixes linked in PR:
https://github.com/vyos/vyos-1x/pull/1768

PR 1.3 https://github.com/vyos/vyos-1x/pull/1951

@Harliff Could you re-check?

PR for 1.3 https://github.com/vyos/vyos-1x/pull/1954

In T5153#146789, @Viacheslav wrote:

Could you send sudo nft list ruleset ?

PR for 1.3 https://github.com/vyos/vyos-1x/pull/1952
PR for 1.4 fix https://github.com/vyos/vyos-1x/pull/1953

For 1.4 rate-limit in the wrong place

set vpn pptp remote-access authentication rate-limit

Expected in the radius section:

set vpn pptp remote-access authentication radius rate-limit

Yes, I forgot to add this task. I'll make the PR

@n.fort Could you add PR for 1.3?

@fernando Could you add PR for 1.3?

PR https://github.com/vyos/vyos-1x/pull/1950

Could you send sudo nft list ruleset ?

In T4891#139693, @RyVolodya wrote:

I reproduced this configuration. Version VyOS 1.4-rolling-202212270317 - BFD works fine.

Configuration:

set interfaces ethernet eth0 address '10.221.3.18/30'
set interfaces ethernet eth0 mtu '9000'
set interfaces ethernet eth0 offload gro
set interfaces ethernet eth0 offload gso
set interfaces ethernet eth0 offload sg
set interfaces ethernet eth0 offload tso

BFD peer status:

BFD Peers:
        peer 10.221.3.17 vrf default
                ID: 2428685750
                Remote ID: 2382320760
                Active mode
                Status: up
                Uptime: 30 minute(s), 19 second(s)
                Diagnostics: ok
                Remote diagnostics: ok
                Peer Type: configured
                RTT min/avg/max: 0/0/0 usec
                Local timers:
                        Detect-multiplier: 5
                        Receive interval: 100ms
                        Transmission interval: 100ms
                        Echo receive interval: 50ms
                        Echo transmission interval: disabled
                Remote timers:
                        Detect-multiplier: 5
                        Receive interval: 100ms
                        Transmission interval: 100ms
                        Echo receive interval: 50ms

[edit]

Try upgrading the VyOS to the latest version.

Fixed in T5047

Notice. Initially this task was about monitoring scripts but they were deprecated. Then aws-cloudwatch-agent emerged.
aws-cloudwatch-agent was successfully added to vyos-build:equuleus. But cloudwatch configuration preservation between image updates is not.
This task was closed mistakenly prematurely thus should be reopen.

PR https://github.com/vyos/vyos-1x/pull/1949

I found the issue. This was caused by bumping the debian packaging scripts from debian/2%2.10-10 to debian/2%2.10-12, which includes https://salsa.debian.org/debian/wpa/-/commit/d204ceb5a2dc33db888eb55b5fee542a1005e69c. This is not compatible with vyos because vyos uses a config path in /run.

Thanks, I ran the ethernet smoke tests, but not the wireless ones. I'll investigate right away.

So we can close it. Thank you for contributing.

kk, will try to remember to setup a box for that; Usually rolling my own images. ;-)

Just waiting for a new rolling image and checking that those commands are present for CLI :)
If all goods we can close it

What is meant with testing? Writing the unit tests? Or seeing whether it actually works? If it is the latter, this is in prod on my boxes for roughly a month ;-)

Targets and logs will be fixed in the next rolling release

My fault, the double quotes were mis-removed in the PR when cleaning code.

Smoketest PR https://github.com/vyos/vyos-1x/pull/1947

done

After applying above rules an a system without any qos configured, it failed to create the redirect, commit was succesfull but tc disk show did not show the redirect. After removing and applying the redirect between commits, the redirect was present.
Changing the max bandwidth to 10mbit and commiting removed the redirect again.

Create please the PR
Thanks.

It cannot pass the smoketest /usr/libexec/vyos/tests/smoke/cli/test_interfaces_wireless.py

06:48:28  DEBUG - test_wireless_access_point_bridge (__main__.WirelessInterfaceTest.test_wireless_access_point_bridge) ... FAIL
06:48:29  DEBUG - test_wireless_access_point_bridge (__main__.WirelessInterfaceTest.test_wireless_access_point_bridge) ... ERROR
06:48:30  DEBUG - test_wireless_add_single_ip_address (__main__.WirelessInterfaceTest.test_wireless_add_single_ip_address) ... ERROR
06:48:32  DEBUG - test_wireless_add_single_ip_address (__main__.WirelessInterfaceTest.test_wireless_add_single_ip_address) ... ERROR
06:48:33  DEBUG - test_wireless_hostapd_config (__main__.WirelessInterfaceTest.test_wireless_hostapd_config) ... FAIL
06:48:34  DEBUG - test_wireless_hostapd_config (__main__.WirelessInterfaceTest.test_wireless_hostapd_config) ... ERROR
06:48:37  DEBUG - test_wireless_hostapd_wpa_config (__main__.WirelessInterfaceTest.test_wireless_hostapd_wpa_config) ... FAIL
06:48:38  DEBUG - test_wireless_hostapd_wpa_config (__main__.WirelessInterfaceTest.test_wireless_hostapd_wpa_config) ... ERROR

Requires some additional work
we need to preserve configuration between upgrade
alternatively, we need to investigate if default config can be used with VM role

PR https://github.com/vyos/vyos-1x/pull/1945

Closing as resolved because the PRs were merged (thanks for the quick review!)

For eapol specifically, if your use case involves only a single chain (1 root CA + 1 or more intermediate CAs), then my fix from T4245 should do the trick. You can add each root/intermediate CA to the PKI and then set eapol to the leaf intermediate CA. When the wpa_supplicant configuration is generated, vyos will add the intermediate CA and all of its parents to the .crt file.

Submitted PRs:

Otp not configured