Console access and initial management — first contact with the box

Before any routing configuration happens, the operator must reach the box. On a fresh install, “reach” means either a physical serial cable and a terminal emulator, or the equivalent provided by the hypervisor or the IPMI controller. This lesson covers the four ways to reach a VyOS 1.5 LTS box, the default account the operator logs in with, and the first three configuration commands the engineer runs before any other change.

The four console paths

flowchart TB
  subgraph Console[Console paths]
    A1[Serial 115200 8N1<br/>RJ45 / USB-DB9]
    A2[VGA + USB keyboard<br/>last resort]
    A3[IPMI / iLO / iDRAC<br/>virtual console]
    A4[Hypervisor console<br/>Proxmox / VMware / KVM]
  end
  subgraph Host[VyOS host]
    H1[getty on ttyS0]
    H2[getty on tty1]
    H3[getty on ttyS0<br/>redirected to IPMI]
    H4[getty on hvc0<br/>virtio-console]
  end
  A1 --> H1
  A2 --> H2
  A3 --> H3
  A4 --> H4
  H1 --> Shell[vyos login prompt]
  H2 --> Shell
  H3 --> Shell
  H4 --> Shell

Default accounts and the first login

The default VyOS image ships with one user account: vyos, password vyos. The vyos account has full sudo access; the root account has no password and cannot be logged in to directly.

vyos login: vyos
Password: vyos
Welcome to VyOS!

Welcome to VyOS - the universal router.

The first thing the engineer must do is change the default password:

vyos@vyos:~$ configure
[edit]
vyos@vyos# set system login user vyos authentication plaintext-password
New password:
Retype password:
[edit]
vyos@vyos# commit
[edit]
vyos@vyos# save
Saving configuration to '/config/config.boot'...
Done
[edit]
vyos@vyos# exit
exit
vyos@vyos:~$

SSH bootstrap with an operator key

For a headless box, the operator injects an SSH key during the first-boot configuration. The cloud image uses cloud-init for this; on bare metal, the operator pastes the key into the configuration:

vyos@vyos:~$ configure
[edit]
vyos@vyos# set system login user vyos authentication plaintext-password
New password:
Retype password:
[edit]
vyos@vyos# set system login user vyos authentication public-keys operator@workstation key 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... operator@workstation'
[edit]
vyos@vyos# set system login user vyos authentication public-keys operator@workstation type ssh-ed25519
[edit]
vyos@vyos# commit
[edit]
vyos@vyos# save

After save, the operator can ssh from the workstation without a password. The plaintext-password entry remains so that the console login still works.

First three configuration commands

Before any routing configuration, the routing engineer runs three commands that every production box needs:

set system host-name <unique-name>
set system time-zone <tz>
set system name-server <resolver>

The hostname must be unique in the routing estate — duplicate hostnames confuse monitoring, syslog, and any downstream automation. The time-zone matters for log readability; NTP for accuracy. The name server matters for add system image (the operator will pull from a package repository).

SSH service hardening

The default SSH configuration listens on port 22 and accepts both password and key authentication. The production hardening removes password authentication and constrains the listen address:

set service ssh listen-address '10.0.0.1'
set service ssh port '2222'
set service ssh authentication public-keys-only

set service ssh listen-address '10.99.0.1'
set service ssh vrf 'mgmt'

Connecting a console server

A multi-router estate usually has a console server — a small device with many serial ports that proxies them over the network as RFC 2217 or raw telnet. The console server hands each port out as a TCP socket; the operator connects to it with telnet or screen:

$ telnet console-server.lab 7001
Trying 10.0.0.50...
Connected to console-server.lab.
Escape character is '^]'.

vyos login: vyos

For automation, the operator uses picocom or screen with the serial line directly:

$ picocom -b 115200 -d 8 -p n -f n /dev/ttyUSB0

How the result is validated

show version
show system host-name
show system login user vyos
show service ssh
show configuration commands | match "set system login"

show service ssh confirms the port, listen address, and public-keys-only flag; show configuration commands | match "set system login" confirms no plaintext passwords survived an incomplete edit.

How it fails

The production failure modes the engineer must recognise:

• Serial line at the wrong baud rate. The output is unreadable or absent. 115200 8N1 is the only correct setting.
• VGA-only box with no serial. A server with no serial header on the motherboard is unreachable from out-of-band. The operator who needs console access is the one who did not check before racking the box.
• Console server with the wrong parity. A console server configured for even parity where the box sends none produces framing errors. Always 8N1 end to end.
• SSH key typo. The pasted key has a stray character. The operator cannot ssh and the box has no IPMI. Recovery: connect via serial, fix the key.
• Default password not changed. The box joins the estate with the documented default credential. The first audit will flag it.
• SSH listening on a routed interface. A box reachable from the public internet with SSH enabled is one credential leak away from being someone else’s router.

Rollback

A console access failure is the worst kind because it cuts the operator off from the box. The recovery path is:

1. Use the IPMI / hypervisor console — never the routed network.
2. From the console, fix the SSH or authentication configuration and commit; save.
3. If the console is also unreachable, power-cycle the box from IPMI and watch the serial output.
4. If IPMI is also unreachable, drive to the DC.

The recovery path that does not exist: ssh from the public internet after a bad configuration change. Always.

Production discipline

Cross-course references

The Linux course’s V-Linux-NetConfig covers the underlying getty and tty configuration. The Ansible course’s XL-Ansible-Bootstrap shows how to drive this from an Ansible playbook. The Observability course’s XII-Observability-HostAgents shows the syslog and SNMP export the operator configures next.

Quiz