- Feed Queries
- All Stories
- Search
- Feed Search
- Transactions
- Transaction Logs
All Stories
Apr 14 2023
#!/usr/bin/env python3 # # Copyright (C) 2022 VyOS maintainers and contributors # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License version 2 or later as # published by the Free Software Foundation. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. #
Apr 13 2023
In T5157#146979, @sdev wrote:Can you share container config section?
Can you share container config section?
If I need to guess, it is just an issue that the BGP session gets configured before the route-maps
As I said, this happens with any config that includes route maps
Self-configuration of the http-api calls a service restart from the config mode script: some re-configuration should be possible without restart; the remaining should provide an explanatory 'success' response. Move to high-priority to address.
This is available in Sagitta thanks to the PKI subsystem; backport depends on backport of that subsystem.
Thanks for clarifying. Yes , I also saw the possibility of extending role based IAM to add on-premise image (that could be interesting for VyOS).
Could you share configuration ? where attached RM and BGP settings:
We can add guidelines about running vyos on LXC/LXD in the documentation
Must run in physical NIC pass-through mode
It is recommended to execute the container in privileged mode
This is currently only an initial implementation!
This should be implemented under the rewrite of system-image-tools:
https://vyos.dev/T4516
This has not been seen subsequently. Close unless recurrence.
Discussed, and ready to be implemented shortly.
Related to T3651.
This will be integrated with the PKI subsystem, using the ideas there.
- In order to apply SSM auto-configuration of the CloudWatch agent, an SSM agent must be installed that installs the CloudWatch agent with the necessary configuration. Currently, there is no SSM agent inside VyOS AWS images, and I haven't heard anything about willingness to include it.
- The amazon-cloudwatch-agent package has only one dependency, libc6. Therefore, it does not need the aws-cli to be configured or set up at all.
- Granting access to the CloudWatch service from an EC2 instance is done by applying the corresponding IAM role to the instance. While it is possible to do this via manual credential input, it is an unwanted practice inside AWS.
- The possible scenario of sending data to CloudWatch out of AWS is unique and requires another Phorge task, I think.
@unity when you need AWS credential , will they be automatically deployed from SSM or will we have to add those credentials in the virtual machine? ? shouldn't aws-cli be integrated?
@Viacheslav confirmed working.
@Viacheslav Confirmed fixed, thank you.
Apr 12 2023
I've created the PR https://github.com/vyos/vyos-documentation/pull/987 as a temporary explanation for users on how to preserve CloudWatch Agent configuration in a semi-automated way, using the SSM Parameter Store.
The firewall for ocserv is handled by https://gitlab.com/openconnect/ocserv/-/blob/master/src/ocserv-fw and uses iptables by default
Supporting (draft) PR and minor fixes linked in PR:
https://github.com/vyos/vyos-1x/pull/1768
@Harliff Could you re-check?
PR for 1.3 https://github.com/vyos/vyos-1x/pull/1954
In T5153#146789, @Viacheslav wrote:Could you send sudo nft list ruleset ?
Apr 11 2023
PR for 1.3 https://github.com/vyos/vyos-1x/pull/1952
PR for 1.4 fix https://github.com/vyos/vyos-1x/pull/1953
For 1.4 rate-limit in the wrong place
set vpn pptp remote-access authentication rate-limit
Expected in the radius section:
set vpn pptp remote-access authentication radius rate-limit
Yes, I forgot to add this task. I'll make the PR
@n.fort Could you add PR for 1.3?
@fernando Could you add PR for 1.3?
Could you send sudo nft list ruleset ?