Page MenuHomePhabricator

Automated config deployment from a removable drive at installation time
Open, WishlistPublicENHANCEMENT

Description

Automated config deployment has a number of use cases, from making OEM installations to transplanting configs from a failed router to new hardware.

While in virtual environments and local network it's fairly easy to retrieve configs over a network securely (in terms of authenticity and confidentiality), if the network admin has taken measures against address spoofing, over a WAN or another insecure network it's problematic. The only way to do it is to include trusted certificates and keys in the image, but it means the image must be custom built, and few people will want to do it.

Deploying configs from a removable drive is a relatively easy and secure option that would allow e.g. branch office personnel or field service technicians to end up with a functional VyOS right after installation.

Behaviour

Copying just the config makes little sense, since it often needs additional files such as keys and certs. The sensible approach is to copy the whole /config dir, together with /config/auth, /config/user-data etc.

The correct removable drive can be identified through udev checks, run+="/somepath/check_if_it_contains_configdir"
The configs can be stored in a specific dir, such as /vyos-configs

Specially for field service technician jobs, we can check if there is more than one subdir and ask which one to use.

Config dirs will be checked by looking if there's config.boot file and if it has a VyOS version string.

Mockup

Support you created a USB stick with the following directory structure:

/
  /vyos-configs
    /office
      config.boot
    /warehouse
      config.boot

Then you plug it in a box and start installing VyOS:

...
Do you want to deploy configuration from a removable drive? [y/N] y
Removable drive contains the following configurations:
   office, warehouse
Select the configuration you want to use: warehouse 
...

Details

Difficulty level
Hard (possibly days)
Version
1.1.8
dmbaturin created this task.Dec 5 2016, 5:32 AM
dmbaturin created this object with edit policy "Subscribers".
hexes added a comment.Dec 5 2016, 11:02 AM
cat /etc/udev/rules.d/100-usbflash.rules 
KERNEL=="sd?1", SUBSYSTEMS=="usb", ACTION=="add", SYMLINK+="adminStick", RUN+="/usr/bin/logger Start mounting", RUN+="/home/vyos/mountAdminStick"
cat /home/vyos/mountAdminStick
#!/bin/bash

DIRECTORY="/media/adminStick"

/usr/bin/logger Creating "$DIRECTORY"
if [ ! -d "$DIRECTORY" ]; then
  mkdir -p "$DIRECTORY"
fi

/usr/bin/logger Trying to mount adminStick
mount /dev/adminStick "$DIRECTORY"

echo "Lets search" > /tmp/eee
find "$DIRECTORY" -name \config.boot -type f | while read CONFIG;
do
    IFVYOS=`grep 'VyOS' "$CONFIG" | wc -l`;
    echo "it vyos $IFVYOS" >> /tmp/eee
    if [ "$IFVYOS" == "1" ]; then
        echo $(dirname "$(readlink -f "$CONFIG")")"/ "$CONFIG >> /tmp/eee
        cat $CONFIG >> /tmp/eee
    fi
done;
cat /tmp/eee 
Lets search
it vyos 0
it vyos 1
/media/adminStick/home/term/ /media/adminStick/home/term/config.boot
it vyos 1
/media/adminStick/home/term/Public/ /media/adminStick/home/term/Public/config.boot
it vyos 1
/media/adminStick/home/term/Pictures/ /media/adminStick/home/term/Pictures/config.boot

But I want to add some extra functions to protect it... What do you think?

I like the concept, although I'm less sure about aggigating the config's together into /tmp/eee rather than using a static config.boot file

For me, the goal would be to have both the ability to within a set of potential configs available, default choose the correct one for the box.

I'd like to see a lookup against a mac address of the interfaces against a directory and if it exists, then copy the content over and reboot. (ship replacement config setup including any custom scripts etc via zip file to a customer/field tech) Otherwise, present the menu options (office,warehouse) and then timeout to a default "custom" config if available

Eg of directory:

/media/adminstick/default/config.boot
/media/adminstick/default/custom-boot-script.sh
/media/adminstick/office/config.boot
/media/adminstick/office/custom-boot-script.sh
/media/adminstick/warehouse/config.boot
/media/adminstick/warehouse/custom-boot-script.sh
/media/adminstick/000ABBCCDDEEFF/config.boot
/media/adminstick/000ABBCCDDEEFF/custom-boot-script.sh

Where mac address: 000ABBCCDDEEFF is that of an interface on another router that is auto configured.

hexes added a comment.Dec 8 2016, 5:15 PM

jclendenan, /tmp/eee is just a sample file where installation script could take a list of available configs.
Almost like you describe below:

/media/adminstick/default/config.boot
/media/adminstick/default/custom-boot-script.sh
/media/adminstick/office/config.boot
/media/adminstick/office/custom-boot-script.sh
/media/adminstick/warehouse/config.boot
/media/adminstick/warehouse/custom-boot-script.sh
/media/adminstick/000ABBCCDDEEFF/config.boot
/media/adminstick/000ABBCCDDEEFF/custom-boot-script.sh

Great, I hadn't realized you were showing the selection method, not the script building.

Works for me, having a mac address lookup as well as a system uuid lookup would be handy for automated building / rebuilding of test env's as well.

jclendenan mentioned this in Unknown Object (Ponder Answer).Dec 10 2016, 2:25 AM
syncer added a subscriber: VyOS 1.2.x.
dmbaturin moved this task from Need Triage to Wishlist on the VyOS 1.2.x board.May 24 2018, 5:54 PM
dmbaturin lowered the priority of this task from Normal to Wishlist.
dmbaturin edited projects, added VyOS 1.3.x; removed VyOS 1.2.x.Sep 2 2018, 9:34 PM
dmbaturin set Version to 1.1.8.
dmbaturin removed a subscriber: VyOS 1.2.x.
syncer changed the subtype of this task from "Task" to "Enhancement".Sat, Oct 20, 4:49 AM