Skip to content

Commit 367495d

Browse files
i-davydenkoi-davydenko
authored
Dev cli sessions (#17623)
sonic-net/SONiC#1367 Why I did it Give ability to: 1. configure limit for active login sessions. 2. configure ssh-server / serial console autologout timeout 3. configure sysrq-capabilities (enable / disable) Work item tracking Microsoft ADO (number only): How I did it Add new service that responsible for serial configuration; Update existing flows for extended ssh-server configurations in hostcfgd; Add YANG model to support new configuration. How to verify it Which release branch to backport (provide reason below if selected) Tested branch (Please provide the tested image version) Description for the changelog Link to config_db schema for YANG module changes [ssh_server](https://github.com/sonic-net/sonic-buildimage/blob/master/src/sonic-yang-models/doc/Configuration.md#ssh_server) [serial_console](https://github.com/sonic-net/sonic-buildimage/blob/master/src/sonic-yang-models/doc/Configuration.md#serial_console)
1 parent 20ea16f commit 367495d

14 files changed

+220
-5
lines changed

‎files/build_templates/sonic_debian_extension.j2

+7
Original file line numberDiff line numberDiff line change
@@ -431,6 +431,13 @@ echo "ntpsec.service" | sudo tee -a $GENERATED_SERVICE_FILE
431431
# Copy DNS templates
432432
sudo cp $BUILD_TEMPLATES/dns.j2 $FILESYSTEM_ROOT_USR_SHARE_SONIC_TEMPLATES/
433433

434+
# Copy cli-sessions config files
435+
sudo cp $IMAGE_CONFIGS/cli_sessions/tmout-env.sh.j2 $FILESYSTEM_ROOT_USR_SHARE_SONIC_TEMPLATES/
436+
sudo cp $IMAGE_CONFIGS/cli_sessions/sysrq-sysctl.conf.j2 $FILESYSTEM_ROOT_USR_SHARE_SONIC_TEMPLATES/
437+
sudo cp $IMAGE_CONFIGS/cli_sessions/serial-config.sh $FILESYSTEM_ROOT/usr/bin/
438+
sudo cp $IMAGE_CONFIGS/cli_sessions/serial-config.service $FILESYSTEM_ROOT_USR_LIB_SYSTEMD_SYSTEM
439+
echo "serial-config.service" | sudo tee -a $GENERATED_SERVICE_FILE
440+
434441
# Copy warmboot-finalizer files
435442
sudo LANG=C cp $IMAGE_CONFIGS/warmboot-finalizer/finalize-warmboot.sh $FILESYSTEM_ROOT/usr/local/bin/finalize-warmboot.sh
436443
sudo LANG=C cp $IMAGE_CONFIGS/warmboot-finalizer/warmboot-finalizer.service $FILESYSTEM_ROOT_USR_LIB_SYSTEMD_SYSTEM

‎files/image_config/cli_sessions/serial-config.service

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
[Unit]
2+
Description=Update serial console config
3+
Requires=sonic.target
4+
After=sonic.target
5+
Before=getty-pre.target
6+
StartLimitIntervalSec=0
7+
8+
[Service]
9+
Type=oneshot
10+
ExecStart=/usr/bin/serial-config.sh
11+
12+
[Install]
13+
WantedBy=sonic.target

‎files/image_config/cli_sessions/serial-config.sh

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#!/bin/bash
2+
3+
# generate conf file for sysrq capabilities.
4+
sonic-cfggen -d -t /usr/share/sonic/templates/sysrq-sysctl.conf.j2 > /etc/sysctl.d/95-sysrq-sysctl.conf
5+
6+
SYSRQ_CONF=0
7+
# update sysrq for current boot.
8+
sysrq_conf=`sonic-db-cli CONFIG_DB HGET "SERIAL_CONSOLE|POLICIES" sysrq_capabilities`
9+
if [ ${sysrq_conf} = "enabled" ]; then
10+
SYSRQ_CONF=1
11+
fi
12+
sudo echo $SYSRQ_CONF > /proc/sys/kernel/sysrq
13+
14+
# generate env file for profile.d to set auto-logout timeout for serial consoles.
15+
sonic-cfggen -d -t /usr/share/sonic/templates/tmout-env.sh.j2 > /etc/profile.d/tmout-env.sh

‎files/image_config/cli_sessions/sysrq-sysctl.conf.j2

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
###############################################################################
2+
# This file was AUTOMATICALLY GENERATED. DO NOT MODIFY.
3+
# Controlled by serial-config.sh
4+
###############################################################################
5+
{% set sysrq = 0 %}
6+
{% set serial_policies = (SERIAL_CONSOLE | d({})).get('POLICIES', {}) -%}
7+
{% if serial_policies.sysrq_capabilities == 'enabled' %}
8+
{% set sysrq = 1 %}
9+
{% endif %}
10+
kernel.sysrq={{ sysrq }}

‎files/image_config/cli_sessions/tmout-env.sh.j2

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{# Default timeout (15 min) #}
2+
{% set inactivity_timeout_sec = 900 %}
3+
4+
{% set serial_pol = (SERIAL_CONSOLE | d({})).get('POLICIES', {}) -%}
5+
{% if serial_pol and serial_pol.inactivity_timeout and serial_pol.inactivity_timeout | int >= 0 %}
6+
{% set inactivity_timeout_sec = serial_pol.inactivity_timeout | int * 60 %}
7+
{% endif %}
8+
9+
{# apply only for serial tty #}
10+
tty | grep -q tty && \
11+
export TMOUT={{ inactivity_timeout_sec }}

‎src/sonic-yang-models/doc/Configuration.md

+23-2
Original file line numberDiff line numberDiff line change
@@ -2694,20 +2694,41 @@ There are 4 classes
26942694
}
26952695
```
26962696
2697+
### SERIAL_CONSOLE
2698+
2699+
In this table collected configuration of the next serial-console attributes:
2700+
- inactivity_timeout - Inactivity timeout for serial-console session, allowed values: 0-35000 (minutes), default value: 15
2701+
- sysrq_capabilities - Enabling or disabling SysRq functionality for serial-console session, allowed values: enabled/disabled, default value disabled
2702+
2703+
```
2704+
{
2705+
SERIAL_CONSOLE:{
2706+
"POLICIES":{
2707+
"inactivity_timeout": 15
2708+
"sysrq_capabilities": "disabled"
2709+
}
2710+
}
2711+
}
2712+
```
2713+
26972714
### SSH_SERVER
26982715
2699-
In this table, we allow configuring ssh server global settings. This will feature includes 3 configurations:
2716+
In this table, we allow configuring ssh server global settings. This will feature includes 5 configurations:
27002717
27012718
- authentication_retries - number of login attepmts 1-100
27022719
- login_timeout - Timeout in seconds for login session for user to connect 1-600
27032720
- ports - Ssh port numbers - string of port numbers seperated by ','
2721+
- inactivity_timeout - Inactivity timeout for SSH session, allowed values: 0-35000 (min), default value: 15 (min)
2722+
- max_sessions - Max number of concurrent logins, allowed values: 0-100 (where 0 means no limit), default value: 0
27042723
```
27052724
{
27062725
"SSH_SERVER": {
27072726
"POLICIES":{
27082727
"authentication_retries": "6",
27092728
"login_timeout": "120",
2710-
"ports": "22"
2729+
"ports": "22",
2730+
"inactivity_timeout": "15",
2731+
"max_sessions": "0"
27112732
}
27122733
}
27132734
}

‎src/sonic-yang-models/setup.py

+3
Original file line numberDiff line numberDiff line change
@@ -203,6 +203,7 @@ def run(self):
203203
'./yang-models/sonic-macsec.yang',
204204
'./yang-models/sonic-bgp-sentinel.yang',
205205
'./yang-models/sonic-bmp.yang',
206+
'./yang-models/sonic-serial-console.yang',
206207
'./yang-models/sonic-smart-switch.yang',]),
207208
('cvlyang-models', ['./cvlyang-models/sonic-acl.yang',
208209
'./cvlyang-models/sonic-banner.yang',
@@ -245,6 +246,7 @@ def run(self):
245246
'./cvlyang-models/sonic-nat.yang',
246247
'./cvlyang-models/sonic-nvgre-tunnel.yang',
247248
'./cvlyang-models/sonic-pbh.yang',
249+
'./cvlyang-models/sonic-ssh-server.yang',
248250
'./cvlyang-models/sonic-policer.yang',
249251
'./cvlyang-models/sonic-port.yang',
250252
'./cvlyang-models/sonic-portchannel.yang',
@@ -280,6 +282,7 @@ def run(self):
280282
'./cvlyang-models/sonic-system-port.yang',
281283
'./cvlyang-models/sonic-macsec.yang',
282284
'./cvlyang-models/sonic-bmp.yang',
285+
'./cvlyang-models/sonic-serial-console.yang',
283286
'./cvlyang-models/sonic-bgp-sentinel.yang']),
284287
],
285288
zip_safe=False,

‎src/sonic-yang-models/tests/files/sample_config_db.json

+10-1
Original file line numberDiff line numberDiff line change
@@ -2448,7 +2448,16 @@
24482448
"POLICIES":{
24492449
"authentication_retries": "6",
24502450
"login_timeout": "120",
2451-
"ports": "22"
2451+
"ports": "22",
2452+
"inactivity_timeout": "15",
2453+
"max_sessions": "0"
2454+
}
2455+
},
2456+
2457+
"SERIAL_CONSOLE": {
2458+
"POLICIES":{
2459+
"inactivity_timeout": "15",
2460+
"sysrq_capabilities": "disabled"
24522461
}
24532462
},
24542463

‎src/sonic-yang-models/tests/yang_model_tests/tests/serial_console.json

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"SERIAL_CONSOLE": {
3+
"desc": "SERIAL_CONSOLE configuration in the Config DB table."
4+
},
5+
"SERIAL_CONSOLE_INVALID_INACTIVITY_TIMEOUT": {
6+
"desc": "SERIAL_CONSOLE attribute 'inactivity_timeout' set to invalid value (out of allowed range of [0, 35000] minutes).",
7+
"eStr": "does not satisfy the constraint \"0..35000\""
8+
},
9+
"SERIAL_CONSOLE_INVALID_SYSRQ" : {
10+
"desc": "SERIAL_CONSOLE attribute 'sysrq' set to invalid value",
11+
"eStr": "Invalid value"
12+
}
13+
}

‎src/sonic-yang-models/tests/yang_model_tests/tests/ssh-server.json

+9-1
Original file line numberDiff line numberDiff line change
@@ -22,5 +22,13 @@
2222
"SSH_SERVER_INVALID_PORTS_2": {
2323
"desc": "Configure invalid port value in SSH_SERVER.",
2424
"eStr": "Invalid port numbers value"
25+
},
26+
"SSH_SERVER_INVALID_INACTIVITY_TIMEOUT": {
27+
"desc": "Configure invalid inactivity_timeout value in SSH_SERVER.",
28+
"eStr": "does not satisfy the constraint \"0..35000\""
29+
},
30+
"SSH_SERVER_INVALID_MAX_SESSIONS": {
31+
"desc": "Configure invalid max_sessions value in SSH_SERVER.",
32+
"eStr": "does not satisfy the constraint \"0..100\""
2533
}
26-
}
34+
}

‎src/sonic-yang-models/tests/yang_model_tests/tests_config/serial_console.json

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"SERIAL_CONSOLE": {
3+
"sonic-serial-console:sonic-serial-console": {
4+
"sonic-serial-console:SERIAL_CONSOLE": {
5+
"POLICIES": {
6+
"inactivity_timeout": 900,
7+
"sysrq_capabilities": "disabled"
8+
}
9+
}
10+
}
11+
},
12+
13+
"SERIAL_CONSOLE_INVALID_INACTIVITY_TIMEOUT": {
14+
"sonic-serial-console:sonic-serial-console": {
15+
"sonic-serial-console:SERIAL_CONSOLE": {
16+
"POLICIES": {
17+
"inactivity_timeout": -500
18+
}
19+
}
20+
}
21+
},
22+
"SERIAL_CONSOLE_INVALID_SYSRQ" : {
23+
"sonic-serial-console:sonic-serial-console": {
24+
"sonic-serial-console:SERIAL_CONSOLE": {
25+
"POLICIES": {
26+
"sysrq_capabilities": "negative"
27+
}
28+
}
29+
}
30+
}
31+
}

‎src/sonic-yang-models/tests/yang_model_tests/tests_config/ssh-server.json

+19-1
Original file line numberDiff line numberDiff line change
@@ -56,5 +56,23 @@
5656
}
5757
}
5858
}
59+
},
60+
"SSH_SERVER_INVALID_INACTIVITY_TIMEOUT": {
61+
"sonic-ssh-server:sonic-ssh-server": {
62+
"sonic-ssh-server:SSH_SERVER": {
63+
"POLICIES":{
64+
"inactivity_timeout": 500000
65+
}
66+
}
67+
}
68+
},
69+
"SSH_SERVER_INVALID_MAX_SESSIONS": {
70+
"sonic-ssh-server:sonic-ssh-server": {
71+
"sonic-ssh-server:SSH_SERVER": {
72+
"POLICIES":{
73+
"max_sessions": 222
74+
}
75+
}
76+
}
5977
}
60-
}
78+
}

‎src/sonic-yang-models/yang-models/sonic-serial-console.yang

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
//filename: sonic-serial-console.yang
2+
module sonic-serial-console {
3+
yang-version 1.1;
4+
namespace "http://github.com/Azure/sonic-serial-console";
5+
prefix cli-sessions;
6+
import sonic-types {
7+
prefix stypes;
8+
}
9+
description "SERIAL_CONSOLE YANG Module for SONiC-based OS";
10+
revision 2023-06-07 {
11+
description "First Revision";
12+
}
13+
container sonic-serial-console {
14+
container SERIAL_CONSOLE {
15+
description "SERIAL_CONSOLE part of config_db.json";
16+
container POLICIES {
17+
leaf inactivity_timeout {
18+
description "serial-console inactivity-timeout timer value in minutes";
19+
type int32 {
20+
range "0..35000";
21+
}
22+
default 15;
23+
}
24+
25+
leaf sysrq_capabilities {
26+
type stypes:admin_mode;
27+
description "managing SysRq capabilities";
28+
default disabled;
29+
}
30+
}
31+
/* end of container POLICIES */
32+
}
33+
/* end of container SERIAL_CONSOLE */
34+
}
35+
/* end of top level container */
36+
}
37+
/* end of module sonic-serial-console */

‎src/sonic-yang-models/yang-models/sonic-ssh-server.yang

+19
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,11 @@ module sonic-ssh-server {
1111
description
1212
"First Revision";
1313
}
14+
15+
revision 2023-06-07 {
16+
description
17+
"Introduce inactivity timeout and max syslogins options";
18+
}
1419

1520
container sonic-ssh-server {
1621
container SSH_SERVER {
@@ -40,6 +45,20 @@ module sonic-ssh-server {
4045
}
4146
}
4247
}
48+
leaf inactivity_timeout {
49+
description "inactivity timeout (in minutes), 0 means no timeout";
50+
default 15;
51+
type uint32 {
52+
range 0..35000;
53+
}
54+
}
55+
leaf max_sessions {
56+
description "limit of concurrent system logins, 0 means no limit";
57+
default 0;
58+
type uint32 {
59+
range 0..100;
60+
}
61+
}
4362
}/*container policies */
4463
} /* container SSH_SERVER */
4564
}/* container sonic-ssh-server */

0 commit comments

Comments
 (0)