User Management: Local Users, SSH Keys, and Access Control

December 5, 2025 · 7 min read

Default VyOS has one user: vyos with password vyos. If that’s still your production setup, you have a security problem. Every scanning bot knows those credentials.

Proper user management means: individual accounts, SSH keys instead of passwords, privilege separation, and audit trails. When something breaks, you need to know who touched what.

Shared accounts are an audit nightmare. Individual accounts with SSH keys are the baseline.

Default User Problem

# Default credentials
Username: vyos
Password: vyos

# Every automated scanner knows this
# First thing to change on new installation

Creating Users

Basic User Creation

configure

# Create admin user with full privileges
set system login user admin full-name "System Administrator"
set system login user admin authentication plaintext-password "SecurePassword123!"

# Create operator user with limited access
set system login user operator full-name "Network Operator"
set system login user operator authentication plaintext-password "OperatorPass456!"
set system login user operator level operator

commit

User Levels

Level	Access
admin	Full configuration access
operator	Show commands, limited operational commands

# Admin level (default)
set system login user admin level admin

# Operator level (read-mostly)
set system login user operator level operator

Operator Limitations

Operators can:

View configuration
Run show commands
Basic operational commands

Operators cannot:

Enter configuration mode
Modify settings
Restart services

SSH Key Authentication

Generate Keys (Client Side)

# On your workstation
ssh-keygen -t ed25519 -C "admin@example.com"
# Or RSA if ed25519 not supported
ssh-keygen -t rsa -b 4096 -C "admin@example.com"

# Get public key
cat ~/.ssh/id_ed25519.pub

Add Key to VyOS

configure

# Add SSH key for user
set system login user admin authentication public-keys admin@workstation key "AAAAC3NzaC1lZDI1NTE5AAAAIBxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
set system login user admin authentication public-keys admin@workstation type ssh-ed25519

# Or for RSA
set system login user admin authentication public-keys admin@workstation key "AAAAB3NzaC1yc2EAAAADAQABAAACAQxxxxxxxxx"
set system login user admin authentication public-keys admin@workstation type ssh-rsa

commit

Multiple Keys Per User

# Work laptop
set system login user admin authentication public-keys work-laptop key "..."
set system login user admin authentication public-keys work-laptop type ssh-ed25519

# Home workstation
set system login user admin authentication public-keys home-desktop key "..."
set system login user admin authentication public-keys home-desktop type ssh-ed25519

# Emergency key (stored securely)
set system login user admin authentication public-keys emergency key "..."
set system login user admin authentication public-keys emergency type ssh-ed25519

Disable Password Authentication

# After adding SSH keys, disable password login
set service ssh disable-password-authentication

commit

# Now only SSH key authentication works

Remove Default User

configure

# First, ensure you can login with new user!
# Test SSH key login in another terminal before deleting vyos user

# Delete default user
delete system login user vyos

commit

# If you lock yourself out, you'll need console access

SSH Service Configuration

Basic SSH Hardening

configure

# Listen only on management interface
set service ssh listen-address 192.168.1.1

# Change port (optional, security through obscurity)
set service ssh port 22222

# Disable password authentication
set service ssh disable-password-authentication

# Set login timeout
set service ssh timeout 120

# Limit authentication attempts
set service ssh max-auth-retries 3

commit

Allowed Networks

# Use firewall to limit SSH source IPs
set firewall ipv4 name MGMT-LOCAL rule 10 action accept
set firewall ipv4 name MGMT-LOCAL rule 10 destination port 22
set firewall ipv4 name MGMT-LOCAL rule 10 protocol tcp
set firewall ipv4 name MGMT-LOCAL rule 10 source address 10.0.0.0/24
set firewall ipv4 name MGMT-LOCAL rule 10 description "SSH from admin network only"

set firewall ipv4 name MGMT-LOCAL rule 999 action drop
set firewall ipv4 name MGMT-LOCAL rule 999 description "Drop all other"

SSH Client Keepalive

# Keep connections alive
set service ssh client-keepalive-interval 60

Per-User Restrictions

Restrict User to Specific Source

Can’t be done directly in VyOS, but use firewall:

# Create group for restricted user's source
set firewall group network-group OPERATOR-NETS network 192.168.10.0/24

# Firewall rule allowing operator SSH only from specific network
# Combined with per-user SSH keys for enforcement

# View current sessions
show users

# View login history
show log | grep -i ssh
show log | grep -i login

# Last logins
last

Emergency Access

Console Access

# Serial console always works
# Configure serial port
set system console device ttyS0 speed 115200

Emergency User

# Create break-glass account
set system login user emergency full-name "Emergency Access"
set system login user emergency authentication public-keys emergency key "..."
set system login user emergency authentication public-keys emergency type ssh-ed25519

# Store private key securely (safe, vault, etc.)
# Only use when normal access fails

Password Policies

VyOS doesn’t have built-in password policies, but best practices:

Strong Passwords

# When setting passwords, enforce complexity
# Minimum 12 characters
# Mix of upper, lower, numbers, symbols

# Example (use password manager to generate)
set system login user admin authentication plaintext-password "K8#mP9$nL2@qR5&w"

Encrypted Password Storage

# VyOS shows passwords encrypted in config
show configuration commands | grep authentication

# Output shows hash, not plaintext:
# set system login user admin authentication encrypted-password '$6$rounds=xxx$...'

Regular Password Rotation

No automated policy, but establish process:

Document rotation schedule
Use calendar reminders
Change all passwords
Update documentation

Service Accounts

For automation (Ansible, scripts):

# Create service account
set system login user ansible full-name "Ansible Automation"
set system login user ansible authentication public-keys ansible-server key "..."
set system login user ansible authentication public-keys ansible-server type ssh-ed25519

# Admin level needed for configuration
set system login user ansible level admin

# Consider: dedicated key per automation tool

Audit Trail

Enable Logging

# VyOS logs authentication events to syslog
show log | grep -i auth

# Send to remote syslog for retention
set system syslog host 10.0.0.100 facility auth level info

What Gets Logged

SSH login success/failure
Configuration changes
Privilege escalation
User source IP

Review Logs

# Recent auth events
show log | grep -i auth | tail -50

# Failed logins
show log | grep -i "Failed password"

# Configuration changes
show log | grep -i commit

Multi-User Setup Example

Complete Setup

configure

# Admin users (full access)
set system login user admin1 full-name "Alice Admin"
set system login user admin1 authentication public-keys laptop key "..."
set system login user admin1 authentication public-keys laptop type ssh-ed25519
set system login user admin1 level admin

set system login user admin2 full-name "Bob Admin"
set system login user admin2 authentication public-keys laptop key "..."
set system login user admin2 authentication public-keys laptop type ssh-ed25519
set system login user admin2 level admin

# Operator users (limited access)
set system login user noc1 full-name "NOC Operator 1"
set system login user noc1 authentication public-keys workstation key "..."
set system login user noc1 authentication public-keys workstation type ssh-ed25519
set system login user noc1 level operator

# Service account (for automation)
set system login user ansible full-name "Ansible Service"
set system login user ansible authentication public-keys server key "..."
set system login user ansible authentication public-keys server type ssh-ed25519
set system login user ansible level admin

# Remove default user
delete system login user vyos

# SSH hardening
set service ssh disable-password-authentication

commit
save

The Lesson

Shared accounts are an audit nightmare. Individual accounts with SSH keys are the baseline.

Minimum requirements:

Individual accounts: One user = one person
SSH keys: No password authentication
Principle of least privilege: Operators don’t need admin
Remove defaults: Delete vyos user
Log everything: Remote syslog for audit

When the next security incident happens:

With shared accounts: “Someone changed something”
With individual accounts: “admin1 changed firewall rule 50 at 14:32 from IP 10.0.0.55”

The audit trail is the difference between “we don’t know” and “here’s exactly what happened.”

Set up users properly from day one. Retrofitting access control during an incident is not fun.