This fixes [ERR] from CLI `show routes`, and broken operational status
in setups with DHCP client enabled by default.
Feature (static routing) introduced in release cycle, no need to bring
up in release notes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
By default, assume that any LED with the function "tp", "sfp" or
"port" is attached to either an Ethernet PHY or MAC, with support for
offloading the "netdev" trigger.
Use green LEDs to indicate link/activity.
Disable any yellow LEDs for now, later on we can add alarm indications
etc. to these.
The template and scripts for generating per-device factory-config have
been spread out across the repo. This is an attempt to gather all the
pieces to a single location for better overview.
Parts of factory-config will be reused for the new fail secure mode, in
the file failure-config. The beginnings of which are in this commit.
Other changes:
- cfg-bootstrap and confd-bootstrap have been collapsed into one
- let gen-hostname + gen-interfaces save to /cfg instead of /etc,
we've moved the /etc directory to read-only storage in /usr/share
- delay start of bootstrap and sysrepo-plugind after syslogd barrier
- set 'norestart' when loading startup-confg and failure-config,
no point in retrying if that fails, just go to error immediately
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch restricts the possible user shells to a subset of the list in
/etc/shells, which is generated by Buildroot. The default is 'false' to
prevent accidental shell access for non-admin role users.
The default shell for the admin user is now /bin/clish, which can be
further locked down before Infix v24.02 LTS.
In case of internal error the default fallback shell is now set to the
customizable LOGIN_SHELL, which currently is /bin/bash.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Add /bin/clish (symlink) to /etc/shells, as well as the traditional
/bin/{true,false} for completeness
- Validate shell string, with fallback to /bin/bash and /bin/sh
- Step infix-system revision, keeping old model in tree
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To set up proper factory defaults in Infix we need to drop the default
/etc/sysrepo datastores, initialized at compile-time by Buildroot when
installing netopeer2. The pre-initialized datastores cannot be set up
with new {factory} data in any other way.
The system factory-config is constructed from two parts: static data and
generated data. The latter is:
- hostname (product name + the three last octets of the base MAC)
- interface defaults (depends on number of ports on the device) that
enable IPv6 link-local on all interfaces, and
- per-device unique SSH hostkey for remote NETCONF access, requires
openssl binary on target. Can maybe use openssh for this (TODO).
The hostkeys are saved in /cfg/factory.d/ to prevent them from being
regenerated on every boot.
The script gen-hostkeys and the update of 10-netconf-server.json are
inspired by the netopeer2 scripts merge_hostkey.sh and merge_config.sh,
which do just about the same thing for regular systems.
We bootstrap sysrepo early with all the required models, netopeer2 as
well as our own, by calling sysrepoctl with initial data for {factory}
and {startup} datastores. A local patch to sysrepo is used to allow it
to look for an /etc/factory-default.json instead of compile-time default
data, the patch allows us to have variable amount of objects in the init
data, e.g. number of interface objects.
A system startup-config is generated, if one is mising, from {running}.
We then drop the initial {running} datastore before starting the daemons
sysrepo-plugind and netopeer2-server so that they, and our plugins, are
ready when we load the system startup-config.
Some sanity checks and debug possibilities:
- Ensure /etc/sysrepo exists before copying factory-config
- Keep factory-default.json for debug
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Keys stored in system specific directory /var/run/sshd/$USER.keys
- Keys are regenerated on each corresponding reconfiguration event
- Deletion of key(s) or user remove all keys
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On May 10, 2023, @troglobit wrote:
> Initial proposal for factory-config, based on example from RFC8341.
This gives the admin user the ability to configure the device over
NETCONF.
This patch adds a new user "admin" with the password "admin". The
password is hashed with sha512 ($6) as a hint to new users attempting
to change the password (avoid the weakest algorithms).
Signed-off-by: Richard Alpe <richard@bit42.se>
