Daniil Baturin
0efde86ea6
build: T7241: remove fastnetmon from the list of services
...
to be disabled by default
2025-04-18 12:42:25 +01:00
Christian Breunig
4ce28b3f8c
T7353: netplug.service is started by vyos-router
...
Netplug daemon is started last after all interfaces got initialized to
properly monitor them for up/down events.
2025-04-13 07:22:10 +02:00
Daniil Baturin
56497dd47d
build: T7301: do not include the GPG image signing key in images
2025-04-01 11:01:43 +01:00
oniko94
0646013a7c
T7278: Fix missing cracklib database files on image update
2025-03-25 14:15:45 +02:00
Christian Breunig
d5db3bf117
T861: use custom Kernel certificate over the root shim signing certificate
2025-03-18 16:24:43 +01:00
Daniil Baturin
b35cbd8363
Merge pull request #931 from jestabro/commitd
...
T7121: Set up communication vyconfd to vyos-commitd
2025-03-18 15:09:02 +00:00
Daniil Baturin
452b17eaca
hooks: T7217: remove Dropbear SSH host keys
...
that may be generated by postinstall scripts
to prevent accidental use of non-unique keys
baked into images
2025-03-17 17:58:33 +00:00
John Estabrook
2c90ce3fd2
T7121: disable vyos-commitd.service until replacement of vyos-configd
2025-03-16 23:59:49 -05:00
Christian Breunig
3d24c1077e
Merge pull request #898 from c-po/syslog-T6989
...
T6989: disable rsyslog service
2025-02-04 18:24:45 +01:00
Christian Breunig
a0ef45b19d
T6989: disable rsyslog service
2025-02-02 21:42:47 +01:00
Viacheslav Hletenko
631934dbea
T7105: Disable by default vpp service until it is configured
2025-01-30 10:04:33 +00:00
Daniil Baturin
15c0bd7578
Merge pull request #824 from jestabro/vyconf-minimal
...
T6718: use the vyconf daemon for validation of set commands
2024-12-06 21:37:58 +00:00
John Estabrook
394ec80f49
T6718: vyconfd.service is started by vyos-router
2024-10-25 10:04:09 -05:00
sarthurdev
61d3585f19
live: T5568: Fix live grub menu entries
2024-10-25 00:07:11 +02:00
Christian Breunig
d235b31a09
T861: sign all Kernel modules with an ephemeral key
...
The shim review board (which is the secure boot base loader) recommends using
ephemeral keys when signing the Linux Kernel. This commit enables the Kernel
build system to generate a one-time ephemeral key that is used to:
* sign all build-in Kernel modules
* sign all other out-of-tree Kernel modules
The key lives in /tmp and is destroyed after the build container exits and is
named: "VyOS build time autogenerated kernel key".
In addition the Kernel now uses CONFIG_MODULE_SIG_FORCE. This now makes it
unable to load any Kernel Module to the image that is NOT signed by the
ephemeral key.
2024-09-25 20:24:21 +02:00
Christian Breunig
53bd06d17b
T861: stripping Kernel modules would also remove module signatures
...
As the VyOS Linux Kernel will be compiled with CONFIG_MODULE_SIG_FORCE all
driver modules need to be cryptographically signed. This happens during build
of the Kernel and it's 3rd party modules.
Stripping the objects would remove said signature and the system will be unable
to boot b/c of CONFIG_MODULE_SIG_FORCE.
2024-09-22 09:31:31 +02:00
Christian Breunig
fd737172f1
T861: add UEFI Secure Boot support
...
This adds support for UEFI Secure Boot. It adds the missing pieces to the Linux
Kernel and enforces module signing. This results in an additional security
layer where untrusted (unsigned) Kernel modules can no longer be loaded into
the live system.
NOTE: This commit will not work unless signing keys are present. Arbitrary
keys can be generated using instructions found in:
data/live-build-config/includes.chroot/var/lib/shim-signed/mok/README.md
2024-09-14 23:05:23 +02:00
Christian Breunig
a9baaaba16
podman: T6598: add custom podman build for version 4.9.5
2024-07-23 08:03:07 +02:00
Christian Breunig
ca31af2cc3
hooks: T6346: set default boot target to multi-user.target
2024-05-16 07:19:59 +02:00
Christian Breunig
fabf5326b8
Merge pull request #582 from 0xThiebaut/suricata
...
suricata: T751: Disable suricata.service by default
2024-05-14 19:27:46 +02:00
Viacheslav Hletenko
618b1379b7
T3420: Remove service upnp
2024-05-14 16:59:59 +00:00
Maxime THIEBAUT
845846108e
suricata: T751: Disable suricata.service by default
2024-05-03 00:31:38 +02:00
Christian Breunig
1a7a54730d
Merge pull request #556 from sever-sever/T6228
...
T6228: Cleanup of not existing systemd units
2024-04-11 16:05:48 +02:00
Viacheslav Hletenko
0622fa1ee5
T6228: Cleanup of not existing systemd units
...
Delete not existing units:
```
06:12:51 Failed to disable unit, unit logd.service does not exist.
06:12:51 Failed to disable unit, unit heartbeat.service does not exist.
```
2024-04-11 12:06:46 +00:00
Viacheslav Hletenko
daf8d44060
T1797: Delete not exist disable vpp service
...
The builder log:
```
06:12:53 Failed to disable unit, unit vpp.service does not exist.
```
2024-04-11 11:32:39 +00:00
Indrajit Raychaudhuri
10b5c5bc93
ssh: T5841: Remove ssh-session-cleanup.service
...
With libpam-systemd >= 230-2, ssh-session-cleanup.service is no longer
necessary because when `UsePAM yes` in `/etc/ssh/sshd_config` (which is
the default), SSH sessions are cleaned up automatically when ssh-server
is shutdown or the system is rebooted.
2023-12-20 01:33:34 -06:00
Christian Breunig
8ce1ae8594
Merge pull request #336 from sarthurdev/kea
...
dhcp: T3316: Disable Kea services
2023-12-09 21:36:00 +01:00
Christian Breunig
a3d29d9110
T4426: disable arpwatch.service by default
2023-12-03 19:25:28 +01:00
John Estabrook
e891c1e160
image: T4516: enable vyos-grub-update service
2023-11-15 08:15:01 -06:00
sarthurdev
ab4b3ee64f
dhcp: T3316: Disable Kea services
2023-10-05 13:53:52 +02:00
Apachez
d47424822d
T5589: Nonstripped binaries exists in VyOS
2023-10-04 16:26:09 +02:00
Apachez
51cf19f135
T5589: Nonstripped binaries exists in VyOS
2023-09-26 23:11:04 +02:00
Apachez
b6d5529ceb
T5589: Nonstripped binaries exists in VyOS
2023-09-26 22:43:29 +02:00
Christian Breunig
2ca594db0d
T5511: drop empty hooks
...
This is a roundup commit to 0be277647 ("T5511: Cleanup of unused directories
(and files) in order to shrink image-size") that dropy empty/commented out
live-build hook scripts.
2023-09-16 08:04:26 +02:00
Apachez
0be277647d
T5511: Cleanup of unused directories (and files) in order to shrink image-size
2023-09-16 05:09:56 +02:00
sarthurdev
d9e93d7353
live: T5568: Add serial boot option to live ISO
2023-09-14 22:04:26 +02:00
Christian Breunig
a9a1ca3cbb
frr: T5239: remove daemons.conf generated by chroot hook
...
Daemon configuration is now generated during boot via vyos-1x repo.
See https://github.com/vyos/vyos-1x/pull/2245
2023-09-11 22:04:20 +02:00
Christian Breunig
1e10c349d4
frr: T5518: enable pim6d
2023-09-01 08:33:45 +02:00
Viacheslav Hletenko
cb330a797e
T5524: Add config directory for livecd
...
Add the '/config' directory for live image boot
One of the reasons the DHCP-server uses lease from this directory T2958
2023-08-30 09:14:59 +00:00
Apachez
b120f757d6
T5511: Cleanup of unused directories (and files) in order to shrink image-size
2023-08-27 00:55:42 +02:00
Apachez
f9946312df
T5468: Remove unused manpages to free up space
2023-08-24 09:22:25 +02:00
Viacheslav Hletenko
11916c657d
T5448: Disable zabbix-agent service by default
2023-08-08 21:21:41 +00:00
Christian Breunig
b400aeff8b
systemd: T5003: sendmail.service no longer exists
2023-08-06 20:56:04 +02:00
Christian Breunig
705a03eb98
systemd: T5003: cleanup timers
2023-08-05 20:26:07 +02:00
Christian Breunig
4d371db4ff
frr: T5415: make mgmtd only listen on localhost
2023-08-04 20:09:45 +02:00
Christian Breunig
dcfbfe9cbb
T3355: enable vyos-router.service
2023-07-15 14:34:30 +02:00
Viacheslav Hletenko
5d3d807ca4
T1797: Disable vpp.service
2023-06-27 16:35:37 +00:00
Christian Breunig
0fda5512f1
T5003: disable non required GPG user services
2023-06-08 21:14:17 +02:00
Christian Breunig
f8e96c8c0d
T5239: disable FRR service - will by started in order by VyOS startup
2023-06-08 21:13:14 +02:00
Christian Breunig
0e7ba50e3d
T5003: disable sendmail service
2023-05-21 23:16:38 +02:00
