Page MenuHomeVyOS Platform

ssh: Upgrade from 1.2.X to 1.3.0 breaks config
Closed, ResolvedPublicBUG

Description

Error while upgrading from 1.2.X to 1.3.X, when multiple ciphers comma-sepparated are defined.
Steps to reproduce:

1 - On fresh install on VyOS 1.2.8:

service ssh ciphers aes128-ctr,aes192-ctr,aes256-ctr

2 - Add 1.3.0 system image and reboot

3 - After reboot, see error in last lines:

[   20.769494] vyos-router[691]: Mounting VyOS Config...done.
[   26.181257] vyos-router[691]: Starting VyOS router: migrate rl-system firewall configure failed!
[   27.076590] vyos-config[708]: Configuration error

Welcome to VyOS - vyos ttyS0

vyos login: vyos
Password:

4 - Verify there's no ssh config loaded:

[email protected]:~$ show config comm | grep ssh
[email protected]:~$

5 - Load config from config.boot file, verify ssh entries, and try to commit:

[email protected]# load /config/config.boot
Loading configuration from '/config/config.boot'
Load complete. Use 'commit' to make changes effective.
[edit]
[email protected]# compare
[edit service]
+ssh {
+    ciphers aes128-ctr,aes192-ctr,aes256-ctr
+    port 22
+}
[edit]
[email protected]# commit
[ service ssh ciphers aes128-ctr,aes192-ctr,aes256-ctr ]


[ service ssh ciphers aes128-ctr,aes192-ctr,aes256-ctr ]
Invalid value

[[service ssh]] failed
Commit failed

On VyOs 1.3.0, ssh ciphers must be defined in different entries, and no in a single one using comma. For this example:

set service ssh ciphers aes128-ctr 
set service ssh ciphers aes192-ctr
set service ssh ciphers aes256-ctr

This error is critical while remote administrating the router, because after upgrade, ssh is not loaded at all!

Details

Difficulty level
Easy (less than an hour)
Version
vyos-1.3.0
Why the issue appeared?
Design mistake
Is it a breaking change?
Config syntax change (migratable)
Issue type
Bug (incorrect behavior)

Related Objects

Mentioned In
1.3.1

Event Timeline

c-po renamed this task from Upgrade from 1.2.X to 1.3.0 - ssh error to ssh: Upgrade from 1.2.X to 1.3.0 breaks config.Feb 28 2022, 1:31 PM
c-po closed this task as Resolved.
c-po changed Difficulty level from Unknown (require assessment) to Easy (less than an hour).
c-po changed Why the issue appeared? from Will be filled on close to Design mistake.
c-po changed Is it a breaking change? from Unspecified (possibly destroys the router) to Config syntax change (migratable).
c-po moved this task from Need Triage to Finished on the VyOS 1.4 Sagitta board.
c-po moved this task from Need Triage to Finished on the VyOS 1.3 Equuleus ( 1.3.1) board.