User Management and Authentication in VyOS

User management and authentication in VyOS provide secure access to the router over SSH, console, and other interfaces. Correct login management configuration is critical to system security.

Overview

User types

System users:

Local users on VyOS
Stored in the configuration
Access over SSH, console, API

Root access:

Root login is disabled by default
Use sudo for administrative commands
Security through limited privileges

Authentication methods

Local authentication - users defined in the VyOS configuration
SSH keys - public keys for passwordless login
RADIUS - centralized authentication
TACACS+ - Cisco-compatible authentication
LDAP - Active Directory integration

Access levels

Admin level:

Full access to the configuration
Can run all commands
sudo access

Operator level:

Read-only access
Can view the configuration
Cannot change settings

Basic configuration

Creating a local user

# Create a user with a password
set system login user alice authentication plaintext-password 'SecurePass123!'

# Full name (optional)
set system login user alice full-name 'Alice Admin'

# Home directory
set system login user alice home-directory '/home/alice'

commit
save

Note: The plaintext password is encrypted automatically on commit.

Verifying users

# List users
show system login

# Current user
whoami

# Active sessions
show system login users

Deleting a user

delete system login user alice
commit

SSH Keys Authentication

Adding an SSH public key

# Add an SSH key for the user
set system login user alice authentication public-keys workstation key 'AAAAB3NzaC1yc2EAAAADAQABAAABAQC...'
set system login user alice authentication public-keys workstation type 'ssh-rsa'

commit

Generating an SSH key on the client:

# On the workstation
ssh-keygen -t rsa -b 4096 -C "alice@company.com"

# Public key
cat ~/.ssh/id_rsa.pub

Multiple SSH keys

# Workstation key
set system login user alice authentication public-keys workstation key 'AAAAB3...'
set system login user alice authentication public-keys workstation type 'ssh-rsa'

# Laptop key
set system login user alice authentication public-keys laptop key 'AAAAB3...'
set system login user alice authentication public-keys laptop type 'ssh-rsa'

# Server key (for automation)
set system login user alice authentication public-keys automation key 'AAAAB3...'
set system login user alice authentication public-keys automation type 'ssh-ed25519'

commit

Disabling password authentication

# SSH keys only
delete system login user alice authentication plaintext-password
delete system login user alice authentication encrypted-password

commit

Encrypted Passwords

Using encrypted passwords

# Generate an encrypted password
mkpasswd -m sha-512

# Or on VyOS
openssl passwd -6 'PlainPassword'

# Use the encrypted password
set system login user bob authentication encrypted-password '$6$rounds=656000$...'

commit

Advantages:

The password is not visible in plaintext
Safer for configuration backups
SHA-512 hashing

User Groups and Privileges

Admin vs Operator

Admin (default):

# Full access
set system login user alice authentication plaintext-password 'Pass123!'

# Admin level is implied
commit

Operator (read-only):

# VyOS does not have a built-in operator level
# Use sudo restrictions or TACACS+ for granular control

Sudo configuration

# All VyOS users have sudo access by default
# To restrict it, use the sudoers file (advanced)

RADIUS Authentication

Basic RADIUS configuration

# RADIUS servers
set system login radius server 192.168.1.10 key 'RadiusSecret123!'
set system login radius server 192.168.1.11 key 'RadiusSecret123!'

# Timeout
set system login radius server 192.168.1.10 timeout 5

# Port (default 1812)
set system login radius server 192.168.1.10 port 1812

# Source address for RADIUS requests
set system login radius source-address 192.168.1.1

commit

RADIUS with fallback

# RADIUS primary
set system login radius server 192.168.1.10 key 'Secret'

# Local fallback if RADIUS is unavailable
# Local users are checked if RADIUS fails

set system login user admin authentication plaintext-password 'EmergencyPass!'

commit

RADIUS accounting

# RADIUS accounting port (default 1813)
set system login radius server 192.168.1.10 acct-port 1813

commit

TACACS+ Authentication

TACACS+ configuration

# TACACS+ servers
set system login tacacs server 192.168.1.20 key 'TacacsSecret123!'

# Port (default 49)
set system login tacacs server 192.168.1.20 port 49

# Timeout
set system login tacacs server 192.168.1.20 timeout 10

# Source address
set system login tacacs source-address 192.168.1.1

commit

TACACS+ privilege levels

TACACS+ supports 15 privilege levels (1-15):

Level 15: Full admin access
Level 1: Read-only

VyOS maps TACACS+ levels as follows:

Level 15 → admin (configure mode)
Level 1-14 → operator (operational mode only)

Password Policies

Minimum requirements

VyOS does not have a built-in password policy engine, but you can apply:

# Password length
# Minimum 8 characters (12+ recommended)

# Complexity
# Use letters, digits, and special characters

# Examples of strong passwords
set system login user alice authentication plaintext-password 'Tr0ng!P@ssw0rd#2024'

Password rotation

# Rotate passwords regularly (every 90 days)
# VyOS does not have automatic expiration
# Use external tools for enforcement

Emergency admin account

# Always keep an emergency admin account
set system login user emergency authentication plaintext-password 'VeryStrongEmergencyPass!'
set system login user emergency full-name 'Emergency Admin Account'

commit

SSH Configuration

SSH server settings

# SSH port
set service ssh port 22

# Listen addresses
set service ssh listen-address 192.168.1.1
set service ssh listen-address 10.0.0.1

# Disable password authentication (keys only)
set service ssh disable-password-authentication

# Disable root login (already disabled by default)
# VyOS does not allow root SSH login

commit

SSH client settings

# SSH to other systems as a specific user
ssh alice@remote-server

# SSH with a specific key
ssh -i /config/auth/id_rsa alice@remote-server

Console Access

Serial console

# The serial console is enabled by default
set system console device ttyS0 speed 9600

commit

Console timeout

# Auto logout after inactivity (seconds)
set system login timeout 300

commit

API Authentication

API keys

# API keys for the HTTPS API
set service https api keys id admin key 'APIKey123456789!'
set service https api keys id readonly key 'ReadOnlyKey987!'

commit

API authentication is separate from system login.

Audit and Logging

Command logging

# All commands are logged automatically to syslog
# View the logs
show log authorization

# Command history
show history

Failed login attempts

# View failed logins
show log authentication

# System log
cat /var/log/auth.log | grep 'Failed'

Syslog for audit

# Send audit logs to a remote syslog
set system syslog host 192.168.1.100 facility authpriv level info

commit

Monitoring and Diagnostics

Active users

# Current login sessions
show system login users

# Who is logged in
who

# Last logins
last

Example output:

USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
alice    pts/0    192.168.1.50     09:15    0.00s  0.04s  0.00s w
bob      pts/1    192.168.1.51     10:23    5:00   0.01s  0.01s -bash

User activity

# What users are doing
w

# Processes by user
ps aux | grep alice

Authentication logs

# SSH authentication
show log authentication

# RADIUS authentication
show log | grep radius

# Detailed auth log
cat /var/log/auth.log

Troubleshooting

Cannot log in over SSH

Problem: SSH connection refused or authentication failed.

Causes:

The SSH service is not running
A firewall is blocking port 22
Incorrect password or SSH key
The user does not exist

Diagnostics:

# On VyOS (over the console):
# Check the SSH service
show service ssh

# Check the firewall
show firewall ipv4 input filter

# Check users
show system login

# SSH daemon status
systemctl status ssh

Solution:

# Start SSH
set service ssh port 22
set service ssh listen-address 0.0.0.0

# Firewall
set firewall ipv4 input filter rule 20 action accept
set firewall ipv4 input filter rule 20 destination port 22
set firewall ipv4 input filter rule 20 protocol tcp

# Check the user
set system login user alice authentication plaintext-password 'NewPass!'

commit

SSH key authentication does not work

Problem: A password prompt appears despite the SSH key.

Causes:

The public key was not added correctly
The key type is not supported
Permissions on the .ssh directory

Solution:

# Check the SSH key
show system login user alice authentication public-keys

# Add it again
set system login user alice authentication public-keys workstation key 'AAAAB3NzaC1...'
set system login user alice authentication public-keys workstation type 'ssh-rsa'

# Remove the password if using keys only
delete system login user alice authentication plaintext-password

commit

On the client:

# Verbose SSH for debugging
ssh -v alice@router

# Check that the key is loaded
ssh-add -l

RADIUS authentication does not work

Problem: RADIUS users cannot log in.

Causes:

The RADIUS server is unreachable
The shared secret is incorrect
A firewall is blocking the RADIUS ports

Diagnostics:

# Ping the RADIUS server
ping 192.168.1.10

# Test RADIUS connectivity
# Check the logs on the RADIUS server

# VyOS auth log
show log authentication | grep radius

Solution:

# Check the RADIUS configuration
show system login radius

# Firewall for RADIUS
set firewall ipv4 output filter rule 50 action accept
set firewall ipv4 output filter rule 50 destination address 192.168.1.10
set firewall ipv4 output filter rule 50 destination port 1812,1813
set firewall ipv4 output filter rule 50 protocol udp

# Check the secret
set system login radius server 192.168.1.10 key 'CorrectSecret'

commit

Locked out of the system

Problem: You changed the configuration and can no longer log in.

Solution over the console:

# Console access always works
# Log in over the console (ttyS0)

# Reset the emergency user password
configure
set system login user emergency authentication plaintext-password 'NewEmergencyPass!'
commit

# Check the SSH service
set service ssh port 22
commit

Solution via ISO/USB:

# Boot from the VyOS ISO
# Mount the configuration
mount /dev/sda1 /mnt
vi /mnt/config/config.boot

# Or reinstall the image
install image

Password forgotten

Problem: You forgot the passwords of all users.

Solution over the console:

# Boot into single user mode
# At the GRUB prompt: add 'init=/bin/bash'

# Mount the filesystem
mount -o remount,rw /

# Create a new user through the config
vi /opt/vyatta/etc/config/config.boot

# Or reset to the default configuration

Security

Security recommendations

Strong passwords:

# Minimum 12 characters, with complexity
set system login user alice authentication plaintext-password 'Str0ng!C0mplex#P@ss'

SSH keys instead of passwords:

set system login user alice authentication public-keys workstation key 'AAAAB3...'
delete system login user alice authentication plaintext-password

set service ssh disable-password-authentication

Change the SSH port:

set service ssh port 2222

# Firewall
set firewall ipv4 input filter rule 20 destination port 2222

Restrict SSH access:

# Only from the management network
set service ssh listen-address 192.168.1.1

# Firewall
set firewall ipv4 input filter rule 20 source address 192.168.1.0/24

Console timeout:

set system login timeout 300

Emergency account:

set system login user emergency authentication plaintext-password 'EmergencyPass!'

RADIUS/TACACS+ for enterprise:

set system login radius server 192.168.1.10 key 'Secret'

Regular audit:

show log authentication
show system login users

Disable unused users:

delete system login user old-employee

Two-factor where possible:
- RADIUS with OTP
- SSH + hardware token

Integration

Active Directory over RADIUS

# Windows NPS as the RADIUS server
# NPS configured for AD authentication

# VyOS RADIUS config
set system login radius server 192.168.1.10 key 'NPSSecret'

commit

LDAP (indirect via RADIUS)

VyOS does not have direct LDAP integration. Use:

FreeRADIUS with an LDAP backend
Windows NPS with AD
Another RADIUS proxy for LDAP

SSH jump host

# VyOS as an SSH jump host
# On the client:
ssh -J alice@vyos-router bob@internal-server

# Or SSH config (~/.ssh/config):
Host internal-server
    ProxyJump alice@vyos-router

Centralized logging

# Send auth logs to a SIEM
set system syslog host 192.168.1.100 facility authpriv level info
set system syslog host 192.168.1.100 facility local0 level info

commit

Configuration Examples

Example 1: Small office (local users)

# Admin user with an SSH key
set system login user admin authentication public-keys workstation key 'AAAAB3NzaC1...'
set system login user admin authentication public-keys workstation type 'ssh-rsa'
set system login user admin full-name 'Administrator'

# Regular users with passwords
set system login user alice authentication plaintext-password 'AlicePass123!'
set system login user alice full-name 'Alice Smith'

set system login user bob authentication plaintext-password 'BobPass456!'
set system login user bob full-name 'Bob Johnson'

# Emergency account
set system login user emergency authentication plaintext-password 'Emergency2024!'

# SSH configuration
set service ssh port 22
set service ssh listen-address 192.168.1.1

# Console timeout
set system login timeout 600

commit
save

Example 2: Enterprise (RADIUS)

# RADIUS authentication
set system login radius server 192.168.1.10 key 'PrimaryRadius2024!'
set system login radius server 192.168.1.11 key 'BackupRadius2024!'
set system login radius server 192.168.1.10 timeout 5
set system login radius source-address 192.168.1.1

# Local admin fallback
set system login user localadmin authentication plaintext-password 'LocalAdminFallback!'
set system login user localadmin full-name 'Local Admin (Emergency)'

# Emergency account
set system login user emergency authentication encrypted-password '$6$rounds=656000$...'

# SSH keys only
set service ssh disable-password-authentication
set service ssh port 2222
set service ssh listen-address 192.168.1.1

# Firewall
set firewall ipv4 input filter rule 20 action accept
set firewall ipv4 input filter rule 20 source address 192.168.1.0/24
set firewall ipv4 input filter rule 20 destination port 2222
set firewall ipv4 input filter rule 20 protocol tcp

# Audit logging
set system syslog host 192.168.1.100 facility authpriv level info

commit
save

Example 3: DevOps (automation)

# Human users
set system login user alice authentication public-keys laptop key 'AAAAB3...'
set system login user alice authentication public-keys laptop type 'ssh-ed25519'

# Automation user
set system login user ansible authentication public-keys automation key 'AAAAB3...'
set system login user ansible authentication public-keys automation type 'ssh-ed25519'
set system login user ansible full-name 'Ansible Automation'

# API keys
set service https api keys id ansible key 'AnsibleAPIKey123456!'

# SSH configuration
set service ssh port 22
set service ssh listen-address 0.0.0.0

# Disable password auth (keys only)
set service ssh disable-password-authentication

commit
save

Best Practices

SSH keys > passwords:
- Always use SSH keys for automation
- Disable password auth where possible
Least privilege:
- Create users with the minimum required permissions
- Use RADIUS/TACACS+ for granular control
Regular audit:
- Review active users
- Remove old accounts
- Monitor failed logins
Strong passwords:
- Minimum 12 characters
- Complexity requirements
- Regular rotation (90 days)
Multi-factor where possible:
- RADIUS with OTP
- SSH keys + password
Emergency access:
- Always keep an emergency account
- Store credentials securely
Centralized auth for enterprise:
- RADIUS/TACACS+ for scalability
- LDAP/AD integration
Console security:
- Physical security for console access
- Timeout for auto logout
Logging:
- Enable comprehensive logging
- Centralized log collection
- Regular review
Documentation:
- Document user accounts
- Access procedures
- Emergency recovery steps

Conclusion

Local users - simple configuration for small environments
SSH keys - passwordless, secure authentication
RADIUS/TACACS+ - centralized authentication for enterprise
Audit logging - tracking of access and actions

Use the authentication method appropriate for your environment:

Small office → local users with SSH keys
Enterprise → RADIUS/TACACS+ with AD integration
DevOps → SSH keys for automation

Correct login management configuration is critical to VyOS security and should be the first step when setting up the system.

Reviewed by OpenNix LLC · Last updated on 29 July 2026

Syslog and Logging in VyOS