SSH global config #1075

ycoheNvidia · 2022-08-31T10:44:19Z

Added HLD of ssh global config

PR title	state	context
[sonic-buildimage] Added ssh configurations to YANG model
[sonic-host-services] Implemented ssh configurations

dgsudharsan · 2022-09-09T19:29:42Z

doc/ssh_config.md

+```
+SSH_GLOBAL:{
+	policies:{
+		"login-attempts": {{num}}


I believe it should be underscore instead of hyphen in logic-attempts. Can you please correct this in other variables too?

dgsudharsan · 2022-09-09T19:32:28Z

doc/ssh_config.md

+| Policy         |      Action                                                               | Param values            | Default OS value |
+|----------------|---------------------------------------------------------------------------|-------------------------|------------------|
+| login attempts |     Number of attempts to try to log in   before rejecting the session    |     3-100               |     6            |
+| login timeout  |     SSH session timeout                                                   |     1-600 (secs)        |     120          |


Should there be an option to disable the timeout? I believe it maps to LoginGraceTime which when specified as 0 disables timeout

Do we want to disable this? Since this is a security item and we should retain it.

dgsudharsan · 2022-09-09T19:34:02Z

doc/ssh_config.md

+}
+```
+#### 1.10.2. ConfigDB schemas
+```


Can we have another table which maps the config_db field to the ssh config option?
e.g. TCP_FORWARDING - AllowTcpForwarding

Why is this required?

dgsudharsan · 2022-09-09T19:34:51Z

doc/ssh_config.md

+|----------------|---------------------------------------------------------------------------|-------------------------|------------------|
+| login attempts |     Number of attempts to try to log in   before rejecting the session    |     3-100               |     6            |
+| login timeout  |     SSH session timeout                                                   |     1-600 (secs)        |     120          |
+| ports          |     Port number for SSH                                                   |     1-65535             |     22           |


Should this be only 'port' instead of 'ports' since we can have only one ssh port?

we want to support multiple ports

doc/ssh_config.md

dgsudharsan · 2022-09-09T19:37:50Z

doc/ssh_config.md

+
+#### 1.7.2 <a name='SSH global policies'></a>SSH global policies
+
+We want to enable configuring the following policies, with default values are taken from OS (Debian):


Can you please mention if the current SONiC defaults match with the defaults that you are proposing. This will highlight that new design is backward compatible.

Current design should match debian standards, if these are in conflict - do we still want to take SONiC basic defaults?

doc/ssh_config.md

davidpil2002

fix typo in HLD file according comments

liat-grozovik · 2022-10-19T12:22:45Z

@qiluo-msft @dgsudharsan any further comments to this HLD?

doc/ssh_config/ssh_config.md

Removed fields that will not be supported in the first phase, added clarification for ssh ports - we want to allow multiple ports configuration

dgsudharsan

@ycoheNvidia What tcp_forwarding and x11_forwarding were removed?

Yarden-Z · 2022-11-27T07:42:37Z

@ycoheNvidia What tcp_forwarding and x11_forwarding were removed?

Due to security concerns from SONiC in adding these commands to the redis db - these options were removed from the commitment.

doc/ssh_config/ssh_config.md

ycoheNvidia · 2023-01-10T08:49:25Z

PR title	state	context
[sonic-buildimage] sonic buildimage ycohe nvidia ssh config
[sonic-host-services] Implemented ssh configurations

liat-grozovik · 2023-01-17T15:36:39Z

@dgsudharsan , @qiluo-msft as you were previously commenting on this feature, could you please review and if no additional feedback appreciate if you can review so we can merge.

liat-grozovik · 2023-01-17T15:37:11Z

@ycoheNvidia could you please check the last PR status indication in the PR description? seems not accurate/missing

ycoheNvidia · 2023-01-19T15:36:37Z

@ycoheNvidia could you please check the last PR status indication in the PR description? seems not accurate/missing

It doesn't seem to be working for this specific repository

liat-grozovik · 2023-01-23T11:27:10Z

@dgsudharsan @qiluo-msft kindly provide your approval/comments.
this HLD and the code PRs are available for quite some time and we wish to move forward and have them merged to master.

doc/ssh_config/ssh_config.md

dgsudharsan · 2023-01-23T16:30:38Z

@dgsudharsan @qiluo-msft kindly provide your approval/comments. this HLD and the code PRs are available for quite some time and we wish to move forward and have them merged to master.

Still one comment needs to be addressed
#1075 (comment)

qiluo-msft

Updated comments.

liat-grozovik · 2023-02-14T07:04:45Z

@qiluo-msft could you please check if your comments were published? I am not sure I see them.

removed [ ] from ports in ConfigDb json

liat-grozovik · 2023-02-27T09:22:30Z

@ycoheNvidia please confirm all comments were addressed. if not, please share a plan.

doc/ssh_config/ssh_config.md

liat-grozovik · 2023-03-07T16:35:41Z

@qiluo-msft @dgsudharsan kindly reminder to review the changes done following review feedback.
Code PRs are available as well.

ycoheNvidia · 2023-03-08T08:52:57Z

As comments

this was already resolved

updated ports regular expression to allow only ports numbers from 1 to 65536

liat-grozovik · 2023-03-21T11:31:29Z

@qiluo-msft kindly reminder to review/approve the HLD first.

HLD in sonic-net/SONiC#1075 - Why I did it Implemented ssh configurations - How I did it Added ssh config table in configDB, once changed - hostcfgd will change the relevant OS files (sshd_config) - How to verify it Tests in added in this PR. User can change relevant configs in configDB such as ports, and see sshd port was modified - Link to config_db schema for YANG module changes https://github.com/ycoheNvidia/SONiC/blob/ssh_config/doc/ssh_config/ssh_config.md

liat-grozovik · 2023-07-10T18:25:11Z

@ycoheNvidia all the PRs related to this feature should be placed in the table of the PR description.
Please add it for better tracking.

As for asking to have the feature as planned for 202305, once all the PRs of the features are merged, please go one by one and add the label for 202305.

liat-grozovik · 2023-07-10T18:30:59Z

@ycoheNvidia all the PRs related to this feature should be placed in the table of the PR description. Please add it for better tracking.

As for asking to have the feature as planned for 202305, once all the PRs of the features are merged, please go one by one and add the label for 202305.

FYI, i update the title of the first PR to align with the PR name.
As of the second one i dont find why it is shown as not avaialble as i do see it sonic-net/sonic-host-services#32
@zhangyanzhao do you have any idea how to sort it out?

skg-net · 2024-02-06T00:31:17Z

@ycoheNvidia Can you please update the Quality Metric (Alpha/Beta/GA) for the feature either in this PR comments or in HLD itself based on https://github.com/sonic-net/SONiC/blob/master/doc/SONiC%20feature%20quality%20definition.md
Thanks

ycoheNvidia · 2024-02-15T09:51:17Z

@skg-net this feature was GA level when approved

ycoheNvidia added 6 commits August 29, 2022 15:03

Add files via upload

f3bd81c

Delete ssh_config_flow.PNG

4db2f4e

Delete ssh_flow_community.PNG

7784e15

Update ssh_config.md

67c16ba

Add files via upload

5394a2b

Update ssh_config.md

c29b1d7

dgsudharsan suggested changes Sep 9, 2022

View reviewed changes

qiluo-msft reviewed Sep 14, 2022

View reviewed changes

doc/ssh_config.md Outdated Show resolved Hide resolved

[ssh_config]Fix typos in HLD file

725dad6

davidpil2002 reviewed Oct 6, 2022

View reviewed changes

Merge branch 'master' into ssh_config

4dcdf06

qiluo-msft requested a review from liuh-80 October 19, 2022 19:05

dgsudharsan suggested changes Nov 15, 2022

View reviewed changes

Update ssh_config.md

4008f19

Removed fields that will not be supported in the first phase, added clarification for ssh ports - we want to allow multiple ports configuration

dgsudharsan reviewed Nov 24, 2022

View reviewed changes

dgsudharsan suggested changes Dec 6, 2022

View reviewed changes

doc/ssh_config/ssh_config.md Show resolved Hide resolved

venkatmahalingam reviewed Dec 13, 2022

View reviewed changes

doc/ssh_config/ssh_config.md Outdated Show resolved Hide resolved

Update ssh_config.md

eb5d525

Merge branch 'master' into ssh_config

b55bbfe

dgsudharsan suggested changes Jan 23, 2023

View reviewed changes

doc/ssh_config/ssh_config.md Show resolved Hide resolved

Update ssh_config.md

c049906

qiluo-msft reviewed Feb 13, 2023

View reviewed changes

Update ssh_config.md

637646f

removed [ ] from ports in ConfigDb json

ycoheNvidia dismissed dgsudharsan’s stale review via 637646f February 15, 2023 06:48

eddyk-nvidia reviewed Mar 3, 2023

View reviewed changes

doc/ssh_config/ssh_config.md Outdated Show resolved Hide resolved

ycoheNvidia added 2 commits March 6, 2023 14:14

Update ssh_config.md

ef9689d

Merge branch 'master' into ssh_config

a70d337

dgsudharsan previously approved these changes Mar 8, 2023

View reviewed changes

Update ssh_config.md

b884d4f

updated ports regular expression to allow only ports numbers from 1 to 65536

ycoheNvidia dismissed dgsudharsan’s stale review via b884d4f March 9, 2023 07:53

dgsudharsan approved these changes Mar 17, 2023

View reviewed changes

Merge branch 'master' into ssh_config

edc6f31

qiluo-msft approved these changes Apr 14, 2023

View reviewed changes

Merge branch 'master' into ssh_config

5844530

liat-grozovik approved these changes May 17, 2023

View reviewed changes

Merge branch 'master' into ssh_config

ea7eccf

liat-grozovik merged commit 17dcf76 into sonic-net:master May 17, 2023

ycoheNvidia mentioned this pull request May 22, 2023

Added ssh configurations to YANG model sonic-net/sonic-buildimage#13338

Merged

3 tasks

ycoheNvidia mentioned this pull request Jun 19, 2023

Implemented ssh configurations sonic-net/sonic-host-services#32

Merged

3 tasks

Yuval-Mellanox assigned Yuval-Mellanox and unassigned Yuval-Mellanox Jul 12, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SSH global config #1075

SSH global config #1075

ycoheNvidia commented Aug 31, 2022 •

edited by liat-grozovik

Loading

dgsudharsan Sep 9, 2022

davidpil2002 Oct 6, 2022

dgsudharsan Sep 9, 2022

Yarden-Z Oct 6, 2022

dgsudharsan Sep 9, 2022

Yarden-Z Oct 6, 2022

dgsudharsan Sep 9, 2022

davidpil2002 Oct 6, 2022

ycoheNvidia Jan 18, 2023

dgsudharsan Sep 9, 2022

Yarden-Z Oct 6, 2022

davidpil2002 left a comment

liat-grozovik commented Oct 19, 2022

dgsudharsan left a comment

Yarden-Z commented Nov 27, 2022

ycoheNvidia commented Jan 10, 2023 •

edited

Loading

liat-grozovik commented Jan 17, 2023

liat-grozovik commented Jan 17, 2023

ycoheNvidia commented Jan 19, 2023

liat-grozovik commented Jan 23, 2023

dgsudharsan commented Jan 23, 2023

qiluo-msft left a comment

liat-grozovik commented Feb 14, 2023

liat-grozovik commented Feb 27, 2023

liat-grozovik commented Mar 7, 2023

ycoheNvidia commented Mar 8, 2023

liat-grozovik commented Mar 21, 2023

liat-grozovik commented Jul 10, 2023

liat-grozovik commented Jul 10, 2023

skg-net commented Feb 6, 2024

ycoheNvidia commented Feb 15, 2024


		#### 1.7.2 <a name='SSH global policies'></a>SSH global policies

		We want to enable configuring the following policies, with default values are taken from OS (Debian):

SSH global config #1075

SSH global config #1075

Conversation

ycoheNvidia commented Aug 31, 2022 • edited by liat-grozovik Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

davidpil2002 left a comment

Choose a reason for hiding this comment

liat-grozovik commented Oct 19, 2022

dgsudharsan left a comment

Choose a reason for hiding this comment

Yarden-Z commented Nov 27, 2022

ycoheNvidia commented Jan 10, 2023 • edited Loading

liat-grozovik commented Jan 17, 2023

liat-grozovik commented Jan 17, 2023

ycoheNvidia commented Jan 19, 2023

liat-grozovik commented Jan 23, 2023

dgsudharsan commented Jan 23, 2023

qiluo-msft left a comment

Choose a reason for hiding this comment

liat-grozovik commented Feb 14, 2023

liat-grozovik commented Feb 27, 2023

liat-grozovik commented Mar 7, 2023

ycoheNvidia commented Mar 8, 2023

liat-grozovik commented Mar 21, 2023

liat-grozovik commented Jul 10, 2023

liat-grozovik commented Jul 10, 2023

skg-net commented Feb 6, 2024

ycoheNvidia commented Feb 15, 2024

ycoheNvidia commented Aug 31, 2022 •

edited by liat-grozovik

Loading

ycoheNvidia commented Jan 10, 2023 •

edited

Loading