Setting admin's password to "!" is not accepted by the model, which
means we end up in RMA mode, even in cases when a valid startup
exists.
Not supplying a password will cause confd to generate a locked
account, which is what we want.
- Fixes the locking warnings when configuring LEDs on 6393X
- Correctly power up 3310X PHYs strapped to start powered down
- Fix kernel oops when reading from blank NVMEM configured with an
ONIE layout
Silence kernel warning seems to be most secure option. Also, set
MFD_CLOEXEC, because if we ever fork off a child it should never
get a copy of this fd.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
New command 'show software' to display software versions on each
partition, install date, and which one is currently booted.
admin@infix-00-00-00:/> show software
NAME STATE VERSION DATE
primary booted v23.10.0-132 2023-11-23T22:24:33+00:00
secondary inactive v23.10.0-132 2023-11-23T22:24:33+00:00
admin@infix-00-00-00:/> show software name primary
Name : primary
State : booted
Version : v23.10.0-132-gfd6e8ea
Size : 61992960
SHA-256 : ed6146aec462b77fb8631b14c48d281dd0f4fdb9c062f9482d863ee854081358
Installed : 2023-11-23T22:24:33+00:00
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The bootstrap script gets feedback from gen-admin-auth, on error we no
longer bail out but instead log the error and continue booting. This
way a developer build with root login can diagnose the error.
When logging the error we also set /etc/issue, /etc/issue.net for local
and remote login services, as well as the dedicated /etc/banner used by
OpenSSH, to hold the error summary. So when attaching to the console
port, or attempting to log in remotely with SSH, the error is printed
to indicate the device is not healthy.
Finally, since factory-config may be missing we need to bootstrap the
sysrepo db with something else, and fortunately we will always have a
failure-config to fall back on.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
If pwhash is missing from system.json, lock account. This allows for
more extensive diagnosis on developer builds with a root login.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Break fallback hash to a separate function and allow gen_qemu_system_file()
to return the status. We'd like to update the qeneth templates to include
the same VPD data as is used with qemu.sh, but for now this is sufficient.
The Qemu detection has been changed to the, slightly more, secure detection
of qemu_fw_cfg filesystem.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds generation of the 20-authentication.json snippet also
for failure-config. The gen-admin-auth script is extended with shell
parameter, since the default shell differs from factory-config.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit does several things. Its end goal is to fetch the admin
password hash from VPD memory during factory bootstrap.
To accomplish this probe creates a new file /run/system.json with
information read from a fw_cfg QEMU partition. The data from
/run/system.json is then later used during config bootstrap to fill in
the factory administrator password.
The idea is to make QEMU behave the same way hardware does, i.e. a
default/factory password should be fetched and used from
"hardware memory". The hardware portion of this is yet to be done.
Signed-off-by: Richard Alpe <richard@bit42.se>
With the behavior introduced in the referenced commit, port
interfaces (i.e. all ports on many systems) no longer get any SLAAC
address, leaving the user with no way of reaching the system.
Comment says this is by design, but that seems like an awkward
default.
Remove the option, and simplify gen_interfaces to either
- Enable SLAAC, if the port is not going to be part of any bridge, or
- Disabel SLAAC, if the port is going to be part of a bridge
If necessary, we can add an inverse option at a later date.
Fixes: d0f3960 ("confd: add -6 option to gen-interfaces for SLACC on port interfaces")
- Add deviations for non-supported statistics
- Limit config, currently we only have ro support
- Add deviations for non-supported configs and status leafs
[skip ci]
Also, add -S option to less, which causes lines longer than the screen
width to be chopped (truncated) rather than wrapped. With available
terminals supporting xterm a user can scroll right on really long lines.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The default srp_show@sysrepo function creates the stripped down version
of running-config that, in the context of showing startup-config or the
factory-config, is very difficult to explain to users why they differ in
format.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Having klish as the login shell means losing lots of neat features we've
gotten used to: help text in less pager, initial terminal probing on the
console, and more.
This commit replaces the clish -> klish symlnk with a fuzzy bash wrapper
that fixes all the above annoying little things.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Before this change, the following would happen in /lib/infix/mnt if a
factory-reset was performed:
1. Copy the contents of /var from Squash into /mnt/var and bind mount
/mnt/var over /var
2. Check for factory-reset
3. Clear /mnt/cfg/* and /mnt/var/*
4. Mount overlays
This ordering leaves the system with a completely empty /var on the
boot when a factory-reset is executed. Finit will fixup some of this
via its tmpfiles scripts, but we want the ability to ship files under
/var as part of the Squash and have these be available after the bind
mount, just like what happens at every other boot, when we don't
perform a factory-reset.
We solve this by delaying the bind mount (1) until after the reset has
been performed, together with all the overlays (4). While we're here,
make the fallback case, where no persistent /var is available, use a
bind mount as well. This should allow containers to be tested on such
setups, and it's one less flavor to test.
New order:
1. Check for factory-reset
2. Clear /mnt/cfg/* and /mnt/var/*
3. Mount overlays
4. Copy the contents of /var from Squash into /mnt/var and bind mount
/mnt/var over /var
Now the only difference between a regular boot and a
"factory-reset-boot" is whether (2) executed or not.
