Modes and user’s configurations

Connect to SoodarOS

There are 3 ways of connecting to router for configuring:

Physical connection:
1. Direct connection( via monitor and keyboard)
2. Console connection( RS-232)
Remote connection:
1. SSH connection

Remote connection

Using well-known SSH Protocol, enabled router remote access.

Example : Having a management interface with address 192.168.1.1/24:
m@m-pc:~$ ssh admin@192.168.1.1
admin@192.168.1.1's password:

Users

Currently, only one admin user is available, named admin. It is the username that is used with SSH connection.

Modes

View mode Admin has access to some show commands to view the router’s state.
Enable mode: Admin can’t change the router’s configs. But he can enable debug commands and some more privileged commands than view mode
Config mode: Full access to the router.

Passwords

SoodarOS is protected by 3 levels of passwords:

Access password
Enable password
Config password

Access password

It’s the primary password to log in with the user. Without having the access password, a person can’t have any access to the router. An admin with knowing only access password is an admin with just view mode privilege.

password: Change access password

Enable password

Put an admin in enable mode. It is asked when the admin issues the enable command.

enable password PASSWORD: Set enable password

no enable password PASSWORD: Disable enable password.

Config password

Is asked when the admin inputs configure in the command line to enter config mode.

enable config password PASSWORD: Set config password

no enable config password PASSWORD: Disable config password

Reset access password

In case access password is forgotten, connect to soodar via console and enter user password

user password: Reset access password. enabled when connected through physical access.

Password length

To force users to set strong passwords, admin can set a minimum length for passwords.

security passwords min-length

Apply a minimum password length policy to the system. Default of 8 characters is set as passwords’ minimum length.

soodar(config)# security password min-length 8

no security passwords min-length: Remove all restrictions about password length.

Login Failures

Admin can ask for details of failed logins. These details are:

User name: The user who was tried to log in to( currently just admin) Medium: Whether it was through SSH or Console Address: In case of the remote login attempt, IP address of the initiator machine. Else it’s 0.0.0.0. Date: Attempting date

show login failures

Example:

soodar# show login failures
admin   ssh:notty       192.168.1.13    Thu Sep 17 09:18
admin   ssh:notty       192.168.1.13    Thu Sep 17 09:18
admin   ssh:notty       192.168.1.13    Thu Sep 17 09:18

Note

Login logs are stored only for 1 month.

Session Management

SoodarOS’ admin can protect the router from DoS attacks and prevent network exhaustion by limiting the SSH authentication tries in a period and blocking the abuser’s IP. Also, he can see currently established sessions and terminate them.

show users: Show current running sessions. Includes line number, session type( console or SSH), session ID, and IP address of the remote user

clear line (0-530): Clear a TTY line and make it usable by terminating the session on that line.

Note

Clearing a line causes all sessions with the same session ID as the cleared session to terminate. In a normal situation, each line has its session ID. But if multiple sessions are run on a single SSH connection, they share the same session ID

login block-for TIME attempts ATTEMPT within PERIOD: Set SSH jailing parameters. If someone tries ATTEMPT( a number in 1 to 10 range) unsuccessful login attempts within PERIOD( [30-600]) seconds, his IP address will be limited for next TIME([10-7200]) seconds. Default values are 600 seconds of jail time for 5 attempts in 30 seconds.

show login blocked-ips: Show in jail IPs.

login unblock <A.B.C.D|X:X::X:X|all>: Unblock an IP and release it from jail. Admin can unblock all blocked IPs with all as command input.

MOTD

Sometimes system administrator needs to set a message, so every user attempting to log in can see it. This could be done by setting a MOTD banner.

banner motd line LINE: Set motd string from an input.

no banner motd: No motd banner string will be printed.

SSH

Soodar serves as a client for the SSH and as an SSH server. Therefore, key management options are provided to users.

SSH Server

ip ssh pubkey-chain: Enter SSH server authorized keys management node.

username USER: Enter authorized public key management node for a user. Any SSH connection attempt to the user with an authorized public key is accepted.

key LINE ..: Add a public key to the user’s authorized keys.

no key HASH: Remove a public key from the user’s authorized keys by its hash.

no key (1-65535): Remove a public key from the user’s authorized keys by its index in the keys list.

show ip ssh pubkey-chain [verbose] [USER]: Show current authorized keys database for USER( if USER is not provided, show database of all users). if verbose option is activated, output complete keys instead of keys’ hashes.

ip ssh port (2000-10000)

The purpose of the command is to change the default SSH listen port from 22 to a specified port number within the specified range.

(2000-10000): Specifies the port number to be used for SSH server. Valid values are integers from 2000 to 10000.

Example:

soodar# show ip ssh pubkey-chain
List is empty
soodar# conf ter
soodar(config)# ip ssh pubkey-chain
soodar(conf-ssh-pubkey)# username admin
soodar(conf-ssh-pubkey-user)# key ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQChX8nvRsv/nmZE8r+ljuVjiwe8riTt+kmSilS44/Wr+EFWbncx/E39QugQba+0I21/wn17bHbQitMMnXjINUITzqwTnnYQ
ekwSFjBuZKWKe4i0fYoYH2cqySHiecGJHaRD40Jw/6+FTDK4c0PdBIg1Vd3hF8H+bCyberpEzaJKwN2WBV4Pp2QQSU4hcIag0CB/5uk2NbO8/Ewa/cVG3uPURzDWA2RRh5SI320clRyYDkmrcPv6zcZ81tFx1t6F12N0/U12n/XQw+5YEL8HlbGEeQVG+p4eHuOBjP4Ta1Pz75F1Os/bylGQzTGlsrH4tAz7nj011XdAVAJ4ZuQ35KIwh0sVzEKVwZ9ZRFvOH4P0ijL59f/VRD878v7kVrRSKmKyZYUoJH4TBSkGEASGUXGYF+zzTI0RAa3+4j9yFaUMJJ1j1OaMq+FshykuX+3DpBKYQ3of3KWNfLHRCGYao7Eh3QOCxUCN5DuAtYhAd/vzF3DkyanO6LnnbCYkg7SFzWE= temp@test
soodar# show ip ssh pubkey-chain
admin:
   1: W7tjsK1S4C+CfMfjQSQzjiRQHPnHNMhFjbmMyOE02wU temp@test (ssh-rsa)
soodar# show ip ssh pubkey-chain verbose
admin:
   1: AAAAB3NzaC1yc2EAAAADAQABAAABgQChX8nvRsv/nmZE8r+ljuVjiwe8riTt+kmSilS44/Wr+EFWbncx/E39QugQba+0I21/wn17bHbQitMMnXjINUITzqwTnnYQekwSFjBuZKWKe4i0fYoYH2cqySHiecGJHaRD4
0Jw/6+FTDK4c0PdBIg1Vd3hF8H+bCyberpEzaJKwN2WBV4Pp2QQSU4hcIag0CB/5uk2NbO8/Ewa/cVG3uPURzDWA2RRh5SI320clRyYDkmrcPv6zcZ81tFx1t6F12N0/U12n/XQw+5YEL8HlbGEeQVG+p4eHuOBjP4Ta1P
z75F1Os/bylGQzTGlsrH4tAz7nj011XdAVAJ4ZuQ35KIwh0sVzEKVwZ9ZRFvOH4P0ijL59f/VRD878v7kVrRSKmKyZYUoJH4TBSkGEASGUXGYF+zzTI0RAa3+4j9yFaUMJJ1j1OaMq+FshykuX+3DpBKYQ3of3KWNfLHRC
GYao7Eh3QOCxUCN5DuAtYhAd/vzF3DkyanO6LnnbCYkg7SFzWE= temp@test (ssh-rsa)

SSH Client

ip ssh client: Enter SSH client known host management node.

known-host <A.B.C.D|X:X::X:X|HOST>: Add a server’s public key(s) ( provided by its IP or hostname) to the known hosts’ list of current users.

show ip ssh client known-host <A.B.C.D|X:X::X:X|HOST>: Show public keys( if any) of a server stored in the known hosts’ list.

Example:

soodar# show ip ssh client known-host 192.168.30.50
soodar# conf ter
soodar(config)# ip ssh client
soodar(conf-ssh-client)# known-host 192.168.30.50 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCwOU2O2nNJGXIN5VT1Q0j7+H9kQQ9FnE0sl9aPQbOg/Sw1ryZyuUmApUFFABL7MDNZTKzWd3BfYsOB
sXOsKOHiGTZCPLbS93tvHAYlkeIcYDR9JJEi4A67nN/zXSoT+Ew78iUADjWH6rQSy4dtg+ScHFAj3Z9P7TQpK8zWJDLgA28d+zyYSwNd/MkF+EPmAH7mPoKkg2EGCpr889pR5mcBiXPVq69yUNFUG7U0D2aqDaGbaXk9TcfqCrktVmjGVF8rY91TaLMJBngVaYYsnT+xdYp8i8nicxbJoYDvvde057soX6mcTLNXI0opUV9K5TPY7Idp6AWCAxhgJ11IN2z+HZGw56xKDVXL0VXNMngxxICqMV5CxhYHraGkyCha1KXnU2rPi8PbYJkJMIlsXZ+hW9oCZs9x6gzvHHdadi3Ox9JZ6KEqLI7OKf8KNd2alZrGUNjlDIlG/jZhWtYdB4W/oFPAWa5YFqDRfu+VJdVnrGqIzr8GWRlPOjAjwOsBcQk= HOST-KEY
soodar# show ip ssh client known-host 192.168.30.50
192.168.30.50 RSA SHA256:bYisVirAvDxXqwbmYIn7IEj6Grdkf6BeTYCJ7LS11s0 HOST-KEY
soodar# ssh test@192.168.30.50
test@192.168.30.50's password:

soodar# show ip ssh client known-host 192.168.30.39
soodar# ssh test@192.168.30.39
The authenticity of host '192.168.30.39 (192.168.30.39)' can't be established.
RSA key fingerprint is SHA256:lJ2gRSCd8Wh0CrcPU8sOlZJdrbff2QrGaJ5zBcZ2S4I.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.30.39' (RSA) to the list of known hosts.
test@192.168.30.39's password:
soodar# show ip ssh client known-host 192.168.30.39
192.168.30.39 RSA SHA256:lJ2gRSCd8Wh0CrcPU8sOlZJdrbff2QrGaJ5zBcZ2S4I