ncs.conf

ncs.conf - NCS daemon configuration file format

Description

Whenever we start (or reload) the NCS daemon it reads its configuration from ./ncs.conf or ${NCS_DIR}/etc/ncs/ncs.conf or from the file specified with the -c option, as described in ncs(1).

Parts of the configuration can be placed in separate files in the ncs.conf.d sub-directory, next to the ncs.conf file. Each of these files should include the ncs-config XML element and the relevant section from the main configuration file. Files without the ".conf" extension will be ignored.

ncs.conf is an XML configuration file formally defined by a YANG model, tailf-ncs-config.yang as referred to in the SEE ALSO section. This YANG file is included in the distribution. The NCS distribution also includes a commented ncs.conf.example file.

A short example: A NCS configuration file which specifies where to find fxs files etc, which facility to use for syslog, that the developer log should be disabled and that the audit log should be enabled. Finally, it also disables clear text NETCONF support:

<?xml version="1.0" encoding="UTF-8"?>
<ncs-config xmlns="http://tail-f.com/yang/tailf-ncs-config/1.0">

  <load-path>
    <dir>/etc/ncs</dir>
    <dir>.</dir>
  </load-path>

  <state-dir>/var/ncs/state</state-dir>

  <cdb>
    <db-dir>/var/ncs/cdb</db-dir>
  </cdb>

  <aaa>
    <ssh-server-key-dir>/etc/ncs/ssh</ssh-server-key-dir>
  </aaa>


  <logs>
    <syslog-config>
      <facility>daemon</facility>
    </syslog-config>
    <developer-log>
      <enabled>false</enabled>
    </developer-log>
    <audit-log>
      <enabled>true</enabled>
    </audit-log>
  </logs>

  <netconf-north-bound>
    <transport>
      <tcp>
        <enabled>false</enabled>
      </tcp>
    </transport>
  </netconf-north-bound>

  <webui>
    <transport>
      <tcp>
        <enabled>false</enabled>
        <ip>0.0.0.0</ip>
        <port>8008>/ip>
      </tcp>
    </transport>
  </webui>
</ncs-config>

Many configuration parameters get their default values as defined in the YANG file. Filename parameters have no default values.

You can use environment variable references in the configuration file to set values or parts of values that need to be configurable during deployment. To do this, use ${VARIABLE}, where VARIABLE is the name of the environment variable. Each variable reference is replaced by the value of the environment variable at startup. Values that are undefined will result in an error unless a default value is specified for it. Default values can be specified with ${VARIABLE:-DefaultValue} where DefaultValue is the value used if the environment variable is undefined.

Configuration Parameters

This section lists all available configuration parameters and their type (within parenthesis) and default values (within square brackets). Parameters are written using a path notation to make it easier to see how they relate to each other.

/ncs-config

NCS configuration.

/ncs-config/validate-utf8

This section defines settings which affect UTF-8 validation.

/ncs-config/validate-utf8/enabled (boolean) [true]

By default (true) NCS will validate any data modeled as 'string' to be valid UTF-8 and conform to yang-string.
NOTE: String data from data providers and in the ncs.conf file itself are not validated.
The possibility to disable UTF-8 validation is supplied because it can help in certain situations if there is data which is invalid UTF-8 or does not conform to yang-string. Disabling UTF-8 and yang-string validation allows invalid data input.
It is possible to check CDB contents for invalid UTF-8 string data with the following
ncs --cdb-validate cdb-dir
Invalid data will need to be corrected manually with UTF-8 validation disabled.
For further details see:

/ncs-config/ncs-ipc-address

NCS listens by default on 127.0.0.1:4569 for incoming TCP connections from NCS client libraries, such as CDB, MAAPI, the CLI, the external database API, as well as commands from the ncs script (such as 'ncs --reload').
The IP address and port can be changed. If they are changed all clients using MAAPI, CDB et.c. must be re-compiled to handle this. See the deployment user-guide on how to do this.
Note that there are severe security implications involved if NCS is instructed to bind(2) to anything but localhost. Read more about this in the NCS IPC section in the System Managent Topics section of the User Guide.

/ncs-config/ncs-ipc-address/ip (ipv4-address | ipv6-address) [127.0.0.1]

The IP address which NCS listens on for incoming connections from the Java library

/ncs-config/ncs-ipc-address/port (port-number) [4569]

The port number which NCS listens on for incoming connections from the Java library

/ncs-config/ncs-ipc-extra-listen-ip (ipv4-address | ipv6-address)

This parameter may be given multiple times.
A list of additional IPs to which we wish to bind the NCS IPC listener. This is useful if we don't want to use the wildcard '0.0.0.0' or '::' addresses in order to never expose the NCS IPC to certain interfaces.

/ncs-config/ncs-ipc-listen-backlog (int32) [128]

The maximum length to which the queue of pending connections for the IPC sockets may grow (see the OS manual page for listen(2)). If a very large number of applications connect to NSO more or less simultaneously at startup, this value may need to be raised to avoid connection failures. Note that the OS may restrict the length to a lower value, e.g. on Linux it is silently truncated to the value in /proc/sys/net/core/somaxconn - i.e. this value may also need to be raised.

/ncs-config/ncs-local-ipc

NCS can be configured to use Unix domain socket instead of TCP for communication with NCS client libraries, such as CDB, MAAPI, the CLI, the external database API, as well as commands from the ncs script (such as 'ncs --reload').
The default path to the Unix domain socket is /tmp/nso/nso-ipc, the value can be changed.

/ncs-config/ncs-local-ipc/enabled (boolean) [false]

If set to 'true', IPC over Unix domain socket is enabled.
Note that when enabled, supported clients need to use this method to connect to NCS as other methods will not be available and the values under ncs-ipc-address will be ignored.

/ncs-config/ncs-local-ipc/path (string) [/tmp/nso/nso-ipc]

Path to the Unix domain socket that should be used for IPC.

/ncs-config/ncs-ipc-access-check

NCS can be configured to restrict access for incoming connections to the IPC listener sockets. The access check requires that connecting clients prove possession of a shared secret.

/ncs-config/ncs-ipc-access-check/enabled (boolean) [false]

If set to 'true', access check for IPC connections is enabled.

/ncs-config/ncs-ipc-access-check/filename (string)

This parameter is mandatory.
filename is the full path to a file containing the shared secret for the IPC access check. The file should be protected via OS file permissions, such that it can only be read by the NCS daemon and client processes that are allowed to connect to the IPC listener sockets.

/ncs-config/enable-shared-memory-schema (boolean) [true]

If set to 'true', then a C program will be started that loads the schema into shared memory (which then can be accessed by e.g Python)

/ncs-config/shared-memory-schema-path (string)

Path to the shared memory file holding the schema. If left unconfigured, it defaults to 'state/schema' in the run-directory. Note that if the value is configured, it must be specified as an absolute path (i.e containing the root directory and all other subdirectories leading to the executable).

/ncs-config/enable-client-template-schemas (boolean) [false]

If set to 'false', then application client libraries, such as MAAPI, will not be able to access the /devices/template/ned-id/config and /compliance/template/ned-id/config schemas. This will reduce the memory usage for large device data models.

/ncs-config/load-path/dir (string)

This parameter is mandatory.
This parameter may be given multiple times.
The load-path element contains any number of dir elements. Each dir element points to a directory path on disk which is searched for compiled and imported YANG files (.fxs files) and compiled clispec files (.ccl files) during daemon startup. NCS also searches the load path for packages at initial startup, or when requested by the /packages/reload action.

/ncs-config/enable-compressed-schema (boolean) [false]

If set to true, NCS's internal storage of the schema information from the .fxs files will be compressed. This will reduce the memory usage for large data models, but may also cause reduced performance when looking up the schema information. The trade off depends on the total amount of schema information and typical usage patterns, thus the effect should be evaluated before enabling this functionality.

/ncs-config/compressed-schema-level (compressed-schema-level-type) [1]

Controls the level of compression when enable-compressed-schema is set to true. Setting the value to 1 results in more aggressive compression at the cost of performance, 2 results in slightly less memory saved, but at higher performance.

/ncs-config/state-dir (string)

This parameter is mandatory.
This is where NCS writes persistent state data. Currently it is used to store a private copy of all packages found in the load path, in a directory tree rooted at 'packages-in-use.cur' (also referenced by a symlink 'packages-in-use'). It is also used for the state files 'running.invalid', which exists only if the running database status is invalid, which it will be if one of the database implementation fails during the two-phase commit protocol, and 'global.data' which is used to store some data that needs to be retained across reboots, and the high-availabillity raft storage consisting of snapshots and file log.

/ncs-config/commit-retry-timeout (xs:duration | infinity) [infinity]

Commit timeout in the NCS backplane. This timeout controls for how long the commit operation in the CLI and the JSON-RPC API will attempt to complete the operation when some other entity is locking the database, e.g. some other commit is in progress or some managed object is locking the database.

/ncs-config/max-validation-errors (uint32 | unbounded) [1]

Controls how many validation errors are collected and presented to the user at a time.

/ncs-config/transaction-lock-time-violation-alarm/timeout (xs:duration | infinity) [infinity]

Timeout before an alarm is raised due to a transaction taking too much time inside of the critical section. 'infinity' or PT0S, i.e. 0 seconds, indicates that the alarm will never be raised.

/ncs-config/notifications

This section defines settings which affect notifications.
NETCONF and RESTCONF northbound notification settings

/ncs-config/notifications/event-streams

Lists all available notification event streams.

/ncs-config/notifications/event-streams/stream

Parameters for a single notification event stream.

/ncs-config/notifications/event-streams/stream/name (string)

The name attached to a specific event stream.

/ncs-config/notifications/event-streams/stream/description (string)

This parameter is mandatory.
A descriptive text attached to a specific event stream.

/ncs-config/notifications/event-streams/stream/replay-support (boolean)

This parameter is mandatory.
Signals if replay support is available for a specific event stream.

/ncs-config/notifications/event-streams/stream/builtin-replay-store

Parameters for the built in replay store for this event stream.
If replay support is enabled NCS automatically stores all notifications on disk ready to be replayed should a NETCONF manager or RESTCONF event notification subscriber ask for logged notifications. The replay store uses a set of wrapping log files on disk (of a certain number and size) to store the notifications.
The max size of each wrap log file (see below) should not be too large. This to acheive fast replay of notifications in a certain time range. If possible use a larger number of wrap log files instead.
If in doubt use the recommended settings (see below).

/ncs-config/notifications/event-streams/stream/builtin-replay-store/enabled (boolean) [false]

If set to 'false', the application must implement its own replay support.

/ncs-config/notifications/event-streams/stream/builtin-replay-store/dir (string)

This parameter is mandatory.
The wrapping log files will be put in this disk location

/ncs-config/notifications/event-streams/stream/builtin-replay-store/max-size (tailf:size)

This parameter is mandatory.
The max size of each log wrap file. The recommended setting is approximately S10M.

/ncs-config/notifications/event-streams/stream/builtin-replay-store/max-files (int64)

This parameter is mandatory.
The max number of log wrap files. The recommended setting is around 50 files.

/ncs-config/opcache

This section defines settings which affect the behavior of the operational data cache.

/ncs-config/opcache/enabled (boolean) [false]

If set to 'true', the cache is enabled.

/ncs-config/opcache/timeout (uint64)

This parameter is mandatory.
The amount of time to keep data in the cache, in seconds.

/ncs-config/hide-group

Hide groups that can be unhidden must be listed here. There can be zero, one or many hide-group entries in the configuraion.
If a hide group does not have a hide-group entry, then it cannot be unhidden using the CLI 'unhide' command. However, it is possible to add a hide-group entry to the ncs.conf file and then use ncs --reload to make it available in the CLI. This may be useful to enable for example a diagnostics hide groups that you do not even want accessible using a password.

/ncs-config/hide-group/name (string)

Name of hide group. This name should correspond to a hide group name defined in some YANG module with 'tailf:hidden'.

/ncs-config/hide-group/password (tailf:md5-digest-string) []

A password can optionally be specified for a hide group. If no password or callback is given then the hide group can be unhidden without giving a password.
If a password is specified then the hide group cannot be enabled unless the password is entered.
To completely disable a hide group, ie make it impossible to unhide it, remove the entire hide-group container for that hide group.

/ncs-config/hide-group/callback (string)

A callback can optionally be specified for a hide group. If no callback or password is given then the hide group can be unhidden without giving a password.
If a callback is specified then the hide group cannot be enabled unless a password is entered and the successfully verifies the password. The callback receives both the name of the hide group, the name of the user issuing the unhide command, and the passowrd.
Using a callback it is possible to have short lived unhide passwords and per-user unhide passwords.

/ncs-config/cdb/db-dir (string)

This parameter is mandatory.
db-dir is the directory on disk which CDB use for its storage and any temporary files being used. It is also the directory where CDB searches for initialization files.

/ncs-config/cdb/persistence/format (in-memory-v1 | on-demand-v1) [in-memory-v1]

/ncs-config/cdb/persistence/db-statistics (disabled | enabled) [disabled]

If set to 'enabled', underlying database produces internal statistics for further observability.

/ncs-config/cdb/persistence/offload/interval (xs:duration | infinity) [5s]

Offload interval time, set to infinity to disable.

/ncs-config/cdb/persistence/offload/threshold/megabytes (uint64)

Megabytes of data that can be used for CDB data before starting to offload.

/ncs-config/cdb/persistence/offload/threshold/system-memory-percentage (uint8) [50]

Percentage of total available RAM that can be used for CDB data before starting to offload. This is the default and should be used unless testing has shown specific requirements.

/ncs-config/cdb/persistence/offload/threshold/max-age (xs:duration | infinity) [infinity]

Maximum age of data before it is offloaded from memory.

/ncs-config/cdb/init-path/dir (string)

This parameter may be given multiple times.
The init-path can contain any number of dir elements. Each dir element points to a directory path which CDB will search for .xml files before looking in db-dir. The directories are searched in the order they are listed.

/ncs-config/cdb/client-timeout (xs:duration | infinity) [infinity]

Specifies how long CDB should wait for a response to e.g. a subscription notification before considering a client unresponsive. If a client fails to call Cdb.syncSubscriptionSocket() within the timeout period, CDB will syslog this failure and then, considering the client dead, close the socket and proceed with the subscription notifications. If set to infinity, CDB will never timeout waiting for a response from a client.

/ncs-config/cdb/subscription-replay/enabled (boolean) [false]

If enabled it is possible to request a replay of the previous subscription notification to a new cdb subscriber.

/ncs-config/cdb/operational

Operational data can either be implemented by external callbacks, or stored in CDB (or a combination of both). The operational datastore is used when data is to be stored in CDB.

/ncs-config/cdb/operational/db-dir (string)

db-dir is the directory on disk which CDB operational uses for its storage and any temporary files being used. If left unset (default) the same directory as db-dir for CDB is used.

/ncs-config/cdb/snapshot

The snapshot datastore is used by the commit queue to calculate the southbound diff towards the devices outside of the transaction lock.

/ncs-config/cdb/snapshot/pre-populate (boolean) [false]

This parameter controls if the snapshot datastore should be pre-populated during upgrade. Switching this on or off implies different trade-offs.
If 'false', NCS is optimized for using normal transaction commits. The snapshot is populated in a lazy manner (when a device is committed through the commit queue for the first time). The drawback is that this commit will suffer performance wise, which is especially true for devices with large configurations. Subsequent commits on the same devices will not have the same penalty.
If 'true', NCS is optimized for systems using the commit queue extensively. This will lead to better performance when committing using the commit queue with no additional penalty for the first time commits. The drawbacks are that upgrade times will increase and an almost doubling of NCS memory consumption.

/ncs-config/compaction/journal-compaction (automatic | manual) [automatic]

Controls the way the CDB files does its journal compaction. Never set to anything but the default 'automatic' unless there is an external mechanism which controls the compaction using the cdb_initiate_journal_compaction() API call.

/ncs-config/compaction/file-size-relative (uint8) [50]

States the threshold in percentage of size increase in a CDB file since the last compaction. By default, compaction is initiated if a CDB file size grows more than 50 percent since the last compaction. If set to 0, the threshold will be disabled.

/ncs-config/compaction/num-node-relative (uint8) [50]

States the threshold in percentage of number of node increase in a CDB file since the last compaction. By default, compaction is initiated if the number of nodes grows more than 50 percent since the last compaction. If set to 0, the threshold will be disabled.

/ncs-config/compaction/file-size-absolute (tailf:size)

States the threshold of size increase in a CDB file since the last compaction. Compaction is initiated if a CDB file size grows more than file-size-absolute since the last compaction.

/ncs-config/compaction/num-transactions (uint16)

States the threshold of number of transactions committed in a CDB file since the last compaction. Compaction is initiated if the number of transactions are greater than num-transactions since the last compaction.

/ncs-config/compaction/delayed-compaction-timeout (xs:duration) [PT5S]

Controls for how long CDB will delay the compaction before initiating. Note that once the timeout elapses, compaction will be initiated only if no new transaction occurs during the delay time.

/ncs-config/encrypted-strings

encrypted-strings defines keys used to encrypt strings adhering to the types tailf:des3-cbc-encrypted-string, tailf:aes-cfb-128-encrypted-string and tailf:aes-256-cfb-128-encrypted-string.

/ncs-config/encrypted-strings/external-keys

Configuration of an external command that will provide the keys used for encrypted-strings. When set no keys for encrypted-strings can be set in the configuration.
When using protocol version '2' of external-keys, see the description in /ncs-config/encrypted-strings/key-rotation for rules applying.

/ncs-config/encrypted-strings/external-keys/command (string)

This parameter is mandatory.
Path to command executed to output keys.

/ncs-config/encrypted-strings/external-keys/command-timeout (xs:duration | infinity) [PT60S]

Command timeout. Timeout is measured between complete lines read from the output.

/ncs-config/encrypted-strings/external-keys/command-argument (string)

Argument available in external-keys command as the environment variable NCS_EXTERNAL_KEYS_ARGUMENT.

/ncs-config/encrypted-strings/key-rotation

Used to store generations of encryption keys.
If migrating from the 'legacy' case (or 'external-keys' without 'EXTERNAL_KEY_FORMAT=2') of /ncs-config/encrypted-strings/method choice, you *must* include the old set of keys as generation '-1'. Otherwise the system will refuse to load the new set of keys, in order not to overwrite the currently active keys that were used to encrypt strings.
If key sets were previously loaded using this list ('key-rotation'), or 'external-keys' with with 'EXTERNAL_KEY_FORMAT=2', you must still provide the currently active generation when loading new keys.
If /ncs-config/encrypted-strings was not defined before, any generations adhering to the type of 'generation' may be added, and the highest generation will be set as the currently active generation, which will be used to encrypt any strings.

/ncs-config/encrypted-strings/key-rotation/generation (int16)

/ncs-config/encrypted-strings/key-rotation/AESCFB128

In the AESCFB128 case one 128 bits (16 bytes) key and a random initial vector are used to encrypt the string. The initVector leaf is OBSOLETED

/ncs-config/encrypted-strings/key-rotation/AESCFB128/key (hex16-value-type)

This parameter is mandatory.

/ncs-config/encrypted-strings/key-rotation/AES256CFB128

In the AES256CFB128 case one 256 bits (32 bytes) key and a random initial vector are used to encrypt the string.

/ncs-config/encrypted-strings/key-rotation/AES256CFB128/key (hex32-value-type)

This parameter is mandatory.

/ncs-config/encrypted-strings/AESCFB128

In the AESCFB128 case one 128 bits (16 bytes) key and a random initial vector are used to encrypt the string. The initVector leaf is OBSOLETED

/ncs-config/encrypted-strings/AESCFB128/key (hex16-value-type)

This parameter is mandatory.

/ncs-config/encrypted-strings/AES256CFB128

In the AES256CFB128 case one 256 bits (32 bytes) key and a random initial vector are used to encrypt the string.

/ncs-config/encrypted-strings/AES256CFB128/key (hex32-value-type)

This parameter is mandatory.

/ncs-config/crypt-hash

crypt-hash specifies how cleartext values should be hashed for leafs of the types ianach:crypt-hash, tailf:sha-256-digest-string, and tailf:sha-512-digest-string.

/ncs-config/crypt-hash/algorithm (md5 | sha-256 | sha-512) [md5]

algorithm can be set to one of the values 'md5', 'sha-256', or 'sha-512', to choose the corresponding hash algorithm for hashing of cleartext input for the ianach:crypt-hash type.

/ncs-config/crypt-hash/rounds (crypt-hash-rounds-type) [5000]

For the 'sha-256' and 'sha-512' algorithms for the ianach:crypt-hash type, and for the tailf:sha-256-digest-string and tailf:sha-512-digest-string types, 'rounds' specifies how many times the hashing loop should be executed. If a value other than the default 5000 is specified, the hashed format will have 'rounds=N$', where N is the specified value, prepended to the salt. This parameter is ignored for the 'md5' algorithm for ianach:crypt-hash.

/ncs-config/logs/syslog-config

Shared settings for how to log to syslog. Logs (see below) can be configured to log to file and/or syslog. If a log is configured to log to syslog, the settings under /ncs-config/logs/syslog-config are used.

This facility setting is the default facility. It's also possible to set individual facilities in the different logs below.

/ncs-config/logs/ncs-log

ncs-log is NCS's daemon log. Check this log for startup problems of the NCS daemon itself. This log is not rotated, i.e. use logrotate(8).

/ncs-config/logs/ncs-log/enabled (boolean) [true]

If set to true, the log is enabled.

/ncs-config/logs/ncs-log/file/name (string)

Name is the full path to the actual log file.

/ncs-config/logs/ncs-log/file/enabled (boolean) [false]

If set to true, file logging is enabled

/ncs-config/logs/ncs-log/syslog/enabled (boolean) [false]

If set to true, syslog messages are sent.

This optional value overrides the /ncs-config/logs/syslog-config/facility for this particular log.

/ncs-config/logs/ncs-log/external/enabled (boolean) [false]

enabled is either 'true' or 'false'. If 'true', send log data to external command for processing.

/ncs-config/logs/developer-log

developer-log is a debug log for troubleshooting user-written Java code. Enable and check this log for problems with validation code etc. This log is enabled by default. In all other regards it can be configured as ncs-log. This log is not rotated, i.e. use logrotate(8).

/ncs-config/logs/developer-log/enabled (boolean) [true]

If set to true, the log is enabled.

/ncs-config/logs/developer-log/file/name (string)

Name is the full path to the actual log file.

/ncs-config/logs/developer-log/file/enabled (boolean) [false]

If set to true, file logging is enabled

/ncs-config/logs/developer-log/syslog/enabled (boolean) [false]

If set to true, syslog messages are sent.

This optional value overrides the /ncs-config/logs/syslog-config/facility for this particular log.

/ncs-config/logs/developer-log/external/enabled (boolean) [false]

enabled is either 'true' or 'false'. If 'true', send log data to external command for processing.

/ncs-config/logs/developer-log-level (error | info | trace) [info]

Controls which level of developer messages are printed in the developer log.

/ncs-config/logs/upgrade-log

Contains information about CDB upgrade. This log is enabled by default and is not rotated, i.e. use logrotate(8).

/ncs-config/logs/upgrade-log/enabled (boolean) [true]

If set to true, the log is enabled.

/ncs-config/logs/upgrade-log/file/name (string)

Name is the full path to the actual log file.

/ncs-config/logs/upgrade-log/file/enabled (boolean) [false]

If set to true, file logging is enabled

/ncs-config/logs/upgrade-log/syslog/enabled (boolean) [false]

If set to true, syslog messages are sent.

This optional value overrides the /ncs-config/logs/syslog-config/facility for this particular log.

/ncs-config/logs/upgrade-log/external/enabled (boolean) [false]

enabled is either 'true' or 'false'. If 'true', send log data to external command for processing.

/ncs-config/logs/audit-log

audit-log is an audit log recording successful and failed logins to the NCS backplane and also user operations performed from the CLI or northbound interfaces. This log is enabled by default. In all other regards it can be configured as /ncs-config/logs/ncs-log. This log is not rotated, i.e. use logrotate(8).

/ncs-config/logs/audit-log/enabled (boolean) [true]

If set to true, the log is enabled.

/ncs-config/logs/audit-log/file/name (string)

Name is the full path to the actual log file.

/ncs-config/logs/audit-log/file/enabled (boolean) [false]

If set to true, file logging is enabled

/ncs-config/logs/audit-log/syslog/enabled (boolean) [false]

If set to true, syslog messages are sent.

This optional value overrides the /ncs-config/logs/syslog-config/facility for this particular log.

/ncs-config/logs/audit-log/external/enabled (boolean) [false]

enabled is either 'true' or 'false'. If 'true', send log data to external command for processing.

/ncs-config/logs/audit-log-commit (boolean) [false]

Controls whether the audit log should include messages about the resulting configuration changes for each commit to the running data store.

/ncs-config/logs/audit-log-commit-defaults (boolean) [false]

Controls whether the audit log should include messages about default values being set. Enabling this may have a performance impact.

/ncs-config/logs/audit-network-log

audit-network-log is an audit log recording southbound traffic towards devices. This log is not rotated, i.e. use logrotate(8).

/ncs-config/logs/audit-network-log/enabled (boolean) [false]

If set to true, the log is enabled.

/ncs-config/logs/audit-network-log/file/name (string)

Name is the full path to the actual log file.

/ncs-config/logs/audit-network-log/file/enabled (boolean) [false]

If set to true, file logging is enabled

/ncs-config/logs/audit-network-log/syslog

Syslog is not available for audit-network-log. These parameters have no effect.

/ncs-config/logs/audit-network-log/syslog/enabled (boolean) [false]

Unsupported.

This optional value overrides the /ncs-config/logs/syslog-config/facility for this particular log.

/ncs-config/logs/audit-network-log/external/enabled (boolean) [false]

enabled is either 'true' or 'false'. If 'true', send log data to external command for processing.

/ncs-config/logs/raft-log

The raft-log is used for tracing raft state and events written by the WhatsApp Raft library used by HA Raft. This log is not rotated, i.e. use logrotate(8).

/ncs-config/logs/raft-log/enabled (boolean) [true]

If set to true, the log is enabled.

/ncs-config/logs/raft-log/file/name (string)

Name is the full path to the actual log file.

/ncs-config/logs/raft-log/file/enabled (boolean) [false]

If set to true, file logging is enabled

/ncs-config/logs/raft-log/syslog

Syslog is not available for raft-log. This parameter has no effect.

/ncs-config/logs/raft-log/syslog/enabled (boolean) [false]

Unsupported.

This optional value overrides the /ncs-config/logs/syslog-config/facility for this particular log.

/ncs-config/logs/raft-log/external/enabled (boolean) [false]

enabled is either 'true' or 'false'. If 'true', send log data to external command for processing.

/ncs-config/logs/raft-log/level (error | info | trace) [info]

The severity level for the message to be logged.

/ncs-config/logs/netconf-log

netconf-log is a log for troubleshooting northbound NETCONF operations, such as checking why e.g. a filter operation didn't return the data requested. This log is enabled by default. In all other regards it can be configured as /ncs-config/logs/ncs-log. This log is not rotated, i.e. use logrotate(8).

/ncs-config/logs/netconf-log/enabled (boolean) [true]

If set to true, the log is enabled.

/ncs-config/logs/netconf-log/file/name (string)

Name is the full path to the actual log file.

/ncs-config/logs/netconf-log/file/enabled (boolean) [false]

If set to true, file logging is enabled

/ncs-config/logs/netconf-log/syslog/enabled (boolean) [false]

If set to true, syslog messages are sent.

This optional value overrides the /ncs-config/logs/syslog-config/facility for this particular log.

/ncs-config/logs/netconf-log/external/enabled (boolean) [false]

enabled is either 'true' or 'false'. If 'true', send log data to external command for processing.

/ncs-config/logs/netconf-log/log-reply-status (boolean) [false]

When set to 'true', NCS extends NETCONF log with rpc-reply status ('ok', 'data', or 'error'). When the type is 'error', the content of the error reply is included in the log output.

/ncs-config/logs/netconf-log/log-get-content (boolean) [false]

When set to 'true', NCS extends NETCONF log with the content of get and get-config RPCs sufficient to enable personal accountability compliance but limited in size to minimize performance impact.

/ncs-config/logs/netconf-log/max-content-size (uint16) [750]

Maximum size of body content of requests or replies included in log when when log-get-content or log-reply-status is set to 'true'. This value has has range of 50 to 5000 characters with a default value of 750.

/ncs-config/logs/jsonrpc-log

jsonrpc-log is a log of JSON-RPC traffic. This log is enabled by default. In all other regards it can be configured as /ncs-config/logs/ncs-log. This log is not rotated, i.e. use logrotate(8).

/ncs-config/logs/jsonrpc-log/enabled (boolean) [true]

If set to true, the log is enabled.

/ncs-config/logs/jsonrpc-log/file/name (string)

Name is the full path to the actual log file.

/ncs-config/logs/jsonrpc-log/file/enabled (boolean) [false]

If set to true, file logging is enabled

/ncs-config/logs/jsonrpc-log/syslog/enabled (boolean) [false]

If set to true, syslog messages are sent.

This optional value overrides the /ncs-config/logs/syslog-config/facility for this particular log.

/ncs-config/logs/jsonrpc-log/external/enabled (boolean) [false]

enabled is either 'true' or 'false'. If 'true', send log data to external command for processing.

/ncs-config/logs/snmp-log/enabled (boolean) [true]

If set to true, the log is enabled.

/ncs-config/logs/snmp-log/file/name (string)

Name is the full path to the actual log file.

/ncs-config/logs/snmp-log/file/enabled (boolean) [false]

If set to true, file logging is enabled

/ncs-config/logs/snmp-log/syslog/enabled (boolean) [false]

If set to true, syslog messages are sent.

This optional value overrides the /ncs-config/logs/syslog-config/facility for this particular log.

/ncs-config/logs/snmp-log/external/enabled (boolean) [false]

enabled is either 'true' or 'false'. If 'true', send log data to external command for processing.

/ncs-config/logs/snmp-log-level (error | info) [info]

Controls which level of SNMP pdus are printed in the SNMP log. The value 'error' means that only PDUs with error-status not equal to 'noError' are printed.

/ncs-config/logs/webui-browser-log

Deprecated. Should not be used.

/ncs-config/logs/webui-browser-log/enabled (boolean) [false]

Deprecated. Should not be used.

/ncs-config/logs/webui-browser-log/filename (string)

This parameter is mandatory.
Deprecated. Should not be used.

/ncs-config/logs/webui-access-log

webui-access-log is an access log for the embedded NCS Web server. This file adheres to the Common Log Format, as defined by Apache and others. This log is not enabled by default and is not rotated, i.e. use logrotate(8).

/ncs-config/logs/webui-access-log/enabled (boolean) [false]

If set to 'true', the access log is used.

/ncs-config/logs/webui-access-log/traffic-log (boolean) [false]

Is either true or false. If true, all HTTP(S) traffic towards the embedded Web server is logged in a log file named traffic.trace. The log file can be used to debugging JSON-RPC/REST/RESTCONF. Beware: Do not use this log in a production setting. This log is not enabled by default and is not rotated, i.e. use logrotate(8).

/ncs-config/logs/webui-access-log/dir (string)

This parameter is mandatory.
The path to the directory whereas the access log should be written to.

/ncs-config/logs/webui-access-log/syslog/enabled (boolean) [false]

If set to true, syslog messages are sent.

This optional value overrides the /ncs-config/logs/syslog-config/facility for this particular log.

/ncs-config/logs/netconf-trace-log

netconf-trace-log is a log for understanding and troubleshooting northbound NETCONF protocol interactions. When this log is enabled, all NETCONF traffic to and from NCS is stored to a file. By default, all XML is pretty-printed. This will slow down the NETCONF server, so be careful when enabling this log. This log is not rotated, i.e. use logrotate(8).
Please note that this means that everything, including potentially sensitive data, is logged. No filtering is done.

/ncs-config/logs/netconf-trace-log/enabled (boolean) [false]

If set to 'true', all NETCONF traffic is logged. NOTE: This configuration parameter takes effect for new sessions while existing sessions will be terminated.

/ncs-config/logs/netconf-trace-log/filename (string)

This parameter is mandatory.
The name of the file where the NETCONF traffic trace log is written.

/ncs-config/logs/netconf-trace-log/external/enabled (boolean) [false]

enabled is either 'true' or 'false'. If 'true', send log data to external command for processing.

/ncs-config/logs/netconf-trace-log/format (pretty | raw) [pretty]

The value 'pretty' means that the XML data is pretty-printed. The value 'raw' means that it is not.

/ncs-config/logs/xpath-trace-log

xpath-trace-log is a log for understanding and troubleshooting XPath evaluations. When this log is enabled, the execution of all XPath queries evaluated by NCS are logged to a file.
This will slow down NCS, so be careful when enabling this log. This log is not rotated, i.e. use logrotate(8).

/ncs-config/logs/xpath-trace-log/enabled (boolean) [false]

If set to 'true', all XPath execution is logged.

/ncs-config/logs/xpath-trace-log/filename (string)

The name of the file where the XPath trace log is written

/ncs-config/logs/xpath-trace-log/external/enabled (boolean) [false]

enabled is either 'true' or 'false'. If 'true', send log data to external command for processing.

/ncs-config/logs/transaction-error-log

transaction-error-log is a log for collecting information on failed transactions that lead to either CDB boot error or runtime transaction failure.

/ncs-config/logs/transaction-error-log/enabled (boolean) [false]

If 'true' on CDB boot error a traceback of the failed load will be logged or in case of a runtime transaction error the transaction information will be dumped to the log.

/ncs-config/logs/transaction-error-log/filename (string)

The name of the file where the transaction error log is written.

/ncs-config/logs/transaction-error-log/external/enabled (boolean) [false]

If 'true', send log data to external command for processing.

/ncs-config/logs/out-of-band-policy-log

out-of-band-policy-log is a log for collecting information on detected and handled out-of-band values. Which rules from which policies were active and which services were affected.

/ncs-config/logs/out-of-band-policy-log/enabled (boolean) [false]

If 'true' detected and handled out-of-band values will logged.

/ncs-config/logs/out-of-band-policy-log/filename (string)

This parameter is mandatory.
The name of the file where the oob policy log is written.

/ncs-config/logs/out-of-band-policy-log-level (error | info | trace) [info]

Controls which level of oob policy messages are printed in the oob policy log.

/ncs-config/logs/ext-log

ext-log is a log for logging events related to external log processing such as process execution, unexpected termination etc.
This log is not rotated, i.e. use logrotate(8).

/ncs-config/logs/ext-log/enabled (boolean) [false]

enabled is either 'true' or 'false'. If 'true', external log processing events is logged.

/ncs-config/logs/ext-log/filename (string)

This parameter is mandatory.
The name of the file where the log for external log processing is written.

/ncs-config/logs/ext-log/level (uint8) [2]

The log level of extLog. 0 is the most critical, 7 is trace logging.

/ncs-config/logs/error-log

error-log is an error log used for internal logging from the NCS daemon. It is used for troubleshooting the NCS daemon itself, and should normally be disabled. This log is rotated by the NCS daemon (see below).

/ncs-config/logs/error-log/enabled (boolean) [false]

If set to 'true', error logging is performed.

/ncs-config/logs/error-log/filename (string)

This parameter is mandatory.
filename is the full path to the actual log file. This parameter must be set if the error-log is enabled.

/ncs-config/logs/error-log/max-size (tailf:size) [S1M]

max-size is the maximum size of an individual log file before it is rotated. Log filenames are reused when five logs have been exhausted.

/ncs-config/logs/error-log/debug/enabled (boolean) [false]

/ncs-config/logs/error-log/debug/level (uint16) [2]

/ncs-config/logs/error-log/debug/tag (string)

This parameter may be given multiple times.

/ncs-config/logs/progress-trace

progress-trace is used for tracing progress events emitted by transactions and actions in the system. It provides useful information for debugging, diagnostics and profiling. Enabling this setting allows progress trace files to be written to the configured directory. What data to be emitted are configured in /progress/trace.

/ncs-config/logs/progress-trace/enabled (boolean) [false]

enabled is either 'true' or 'false'. If 'true', progress trace files are written to the configured directory.

/ncs-config/logs/progress-trace/dir (string)

This parameter is mandatory.
The directory path to the location of the progress trace files.

/ncs-config/logs/external/enabled (boolean) [false]

/ncs-config/logs/external/command (string)

This parameter is mandatory.
Path to command executed to process log data from stdin.

/ncs-config/logs/external/restart/max-attempts (uint8) [3]

Max restart attempts within period, includes time used by delay. If maxAttempts restarts is exceeded the external processing will be disabled until a reload is issued or the configuration is changed.

/ncs-config/logs/external/restart/delay (xs:duration | infinity) [PT1S]

Delay between start attempts if the command failed to start or stopped unexpectedly.

/ncs-config/logs/external/restart/period (xs:duration | infinity) [PT30S]

Period of time start attempts are counted in. Period is reset if a command runs for more than period amount of time.

/ncs-config/sort-transactions (boolean) [true]

This parameter controls how NCS lists newly created, not yet committed list entries. If this value is set to 'false', NCS will list all new elements before listing existing data.
If this value is set to 'true', NCS will merge new and existing entries, and provide one sorted view of the data. This behavior works well when CDB is used to store configuration data, but if an external data provider is used, NCS does not know the sort order, and can thus not merge the new entries correctly. If an external data provider is used for configuration data, and the sort order differs from CDB's sort order, this parameter should be set to 'false'.

/ncs-config/enable-inactive (boolean) [true]

This parameter controls if the NCS's inactive feature should be enabled or not. When NCS is used to control Juniper routers, this feature is required

/ncs-config/enable-origin (boolean) [false]

This parameter controls if NCS's NMDA origin feature should be enabled or not.

/ncs-config/session-limits

Parameters for limiting concurrent access to NCS.

/ncs-config/session-limits/max-sessions (uint32 | unbounded) [unbounded]

Puts a limit on the total number of concurrent sessions to NCS.

/ncs-config/session-limits/session-limit

Parameters for limiting concurrent access for a specific context to NCS. There can be multiple instances of this container element, each one specifying parameters for a specific context.

/ncs-config/session-limits/session-limit/context (string)

The context is either one of cli, netconf, webui, snmp or it can be any other context string defined through the use of MAAPI. As an example, if we use MAAPI to implement a CORBA interface to NCS, our MAAPI program could send the string 'corba' as context.

/ncs-config/session-limits/session-limit/max-sessions (uint32 | unbounded)

This parameter is mandatory.
Puts a limit on the total number of concurrent sessions to NCS.

/ncs-config/session-limits/max-config-sessions (uint32 | unbounded) [unbounded]

Puts a limit on the total number of concurrent configuration sessions to NCS.

/ncs-config/session-limits/config-session-limit

Parameters for limiting concurrent read-write transactions for a specific context to NCS. There can be multiple instances of this container element, each one specifying parameters for a specific context.

/ncs-config/session-limits/config-session-limit/context (string)

The context is either one of cli, netconf, webui, snmp, or it can be any other context string defined through the use of MAAPI. As an example, if we use MAAPI to implement a CORBA interface to NCS, our MAAPI program could send the string 'corba' as context.

/ncs-config/session-limits/config-session-limit/max-sessions (uint32 | unbounded)

This parameter is mandatory.
Puts a limit to the total number of concurrent configuration sessions to NCS for the corresponding context.

/ncs-config/transaction-limits

Parameters for limiting the number of concurrent transactions being applied in NCS.

/ncs-config/transaction-limits/max-transactions (uint8 | unbounded | logical-processors) [logical-processors]

Puts a limit on the total number of concurrent transactions being applied towards the running datastore.
If this value is too high it can cause performance degradation due to increased contention on system internals and resources.
In some cases, especially when transactions are prone to conflicting or other parts of the system has high load, the optimal value for this setting can be smaller than the number of logical processors.

/ncs-config/transaction-limits/scheduling-mode (relaxed | strict) [relaxed]

/ncs-config/parser-limits

Parameters for limiting parsing of XML data.

/ncs-config/parser-limits/max-processing-instruction-length (uint32 | unbounded | model) [32768]

Maximum number of bytes for processing instructions.

/ncs-config/parser-limits/max-tag-length (uint32 | unbounded | model) [1024]

Maximum number of bytes for tag names excluding namespace prefix.

/ncs-config/parser-limits/max-attribute-length (uint32 | unbounded | model) [1024]

Maximum number of bytes for attribute names including namespace prefix.

/ncs-config/parser-limits/max-attribute-value-length (uint32 | unbounded) [unbounded]

Maximum number of bytes for attribute values in escaped form.

/ncs-config/parser-limits/max-attribute-count (uint32 | unbounded | model) [64]

Maximum number of attributes on a single tag.

/ncs-config/parser-limits/max-xmlns-prefix-length (uint32 | unbounded) [1024]

Maximum number of bytes for xmlns prefix.

/ncs-config/parser-limits/max-xmlns-valueLength (uint32 | unbounded | model) [1024]

Maximum number of bytes for a namespace value in escaped form.

/ncs-config/parser-limits/max-xmlns-count (uint32 | unbounded) [1024]

Maximum number of xmlns declarations on a single tag.

/ncs-config/parser-limits/max-data-length (uint32 | unbounded) [unbounded]

Maximum number of bytes of continuous data.

/ncs-config/aaa

The login procedure to NCS is fully described in the NCS User Guide.

/ncs-config/aaa/ssh-login-grace-time (xs:duration) [PT10M]

NCS servers close ssh connections after this time if the client has not successfully authenticated itself by then. If the value is 0, there is no time limit for client authentication.
This is a global value for all ssh servers in NCS.
Modification of this value will only affect ssh connections that are established after the modification has been done.

/ncs-config/aaa/ssh-max-auth-tries (uint32 | unbounded) [unbounded]

NCS servers close ssh connections when the client has made this number of unsuccessful authentication attempts.
This is a global value for all ssh servers in NCS.
Modification of this value will only affect ssh connections that are established after the modification has been done.

/ncs-config/aaa/ssh-server-key-dir (string)

ssh-server-key-dir is the directory file path where the keys used by the NCS SSH daemon are found. This parameter must be set if SSH is enabled for NETCONF or the CLI. If SSH is enabled, the server keys used by NCS are om the same format as the server keys used by openssh, i.e. the same format as generated by 'ssh-keygen'
Only DSA- and RSA-type keys can be used with the NCS SSH daemon, as generated by 'ssh-keygen' with the '-t dsa' and '-t rsa' switches, respectively.
The key must be stored with an empty passphrase, and with the name 'ssh_host_dsa_key' if it is a DSA-type key, and with the name 'ssh_host_rsa_key' if it is an RSA-type key.
The SSH server will advertise support for those key types for which there is a key file available and for which the required algorithm is enabled, see the /ncs-config/ssh/algorithms/server-host-key leaf.

/ncs-config/aaa/ssh-pubkey-authentication (none | local | system) [system]

Controls how the NCS SSH daemon locates the user keys for public key authentication.
If set to 'none', public key authentication is disabled.
If set to 'local', and the user exists in /aaa/authentication/users, the keys in the user's 'ssh_keydir' directory are used.
If set to 'system', the user is first looked up in /aaa/authentication/users, but only if /ncs-config/aaa/local-authentication/enabled is set to 'true' - if local-authentication is disabled, or the user does not exist in /aaa/authentication/users, but the user does exist in the OS password database, the keys in the user's $HOME/.ssh directory are used.

/ncs-config/aaa/default-group (string)

If the group of a user cannot be found in the AAA sub-system, a logged in user will end up as a member of the default group (if specified). If a user logs in and the group membership cannot be established, the user will have zero access rights.

/ncs-config/aaa/auth-order (string)

The default order for authentication is 'local-authentication pam external-authentication'. It is possible to change this order through this parameter

/ncs-config/aaa/validation-order (string)

By default the AAA system will try token validation for a user by the external-validation configurables, as that is the only one currently available - i.e. an external program is invoked to validate the token.
The default is thus:

/ncs-config/aaa/challenge-order (string)

By default the AAA system will try the challenge mechanisms for a user by the challenge configurables, invoking them in order to authenticate the challenge id and response.
The default is:

/ncs-config/aaa/expiration-warning (ignore | display | prompt) [ignore]

When PAM or external authentication is used, the authentication mechanism may give a warning that the user's password is about to expire. This parameter controls how the NCS daemon processes that warning message.
If set to 'ignore', the warning is ignored.
If set to 'display', interactive user interfaces will display the warning message at login time.
If set to 'prompt', interactive user interfaces will display the warning message at login time, and require that the user acknowledges the message before proceeding.

/ncs-config/aaa/audit-user-name (known | never) [known]

Controls the logging of the user name when a failed authentication attempt is logged to the audit log.
If set to "known", the user name is only logged when it is known to be valid (i.e. when attempting local-authentication and the user exists in /aaa/authentication/users), otherwise it is logged as "[withheld]".
If set to "never", the user name is always logged as "[withheld]".

/ncs-config/aaa/max-password-length (uint16) [1024]

The maximum length of the cleartext password for all forms of password authentication. Authentication attempts using a longer password are rejected without attempting verification.
The hashing algorithms used for password verification, in particular those based on sha-256 and sha-512, require extremely high amounts of CPU usage when verification of very long passwords is attempted.

/ncs-config/aaa/pam

If PAM is to be used for login the NCS daemon typically must run as root.

/ncs-config/aaa/pam/enabled (boolean) [false]

When set to 'true', NCS uses PAM for authentication.

/ncs-config/aaa/pam/service (string) [common-auth]

The PAM service to be used for the login NETCONF/SSH CLI procedure. This can be any service we have installed in the /etc/pam.d directory. Different unices have different services installed under /etc/pam.d - choose a service which makes sense or create a new one.

/ncs-config/aaa/pam/timeout (xs:duration) [PT10S]

The maximum time that authentication will wait for a reply from PAM. If the timeout is reached, the PAM authentication will fail, but authentication attempts may still be done with other mechanisms as configured for /ncs-config/aaa/authOrder. Default is PT10S, i.e. 10 seconds.

/ncs-config/aaa/restconf/auth-cache-ttl (xs:duration) [PT10S]

The amount of time that RESTCONF locally caches authentication credentials before querying the AAA server. Default is PT10S, i.e. 10 seconds. Setting to PT0S, i.e. 0 seconds, effectively disables the authentication cache.

/ncs-config/aaa/restconf/enable-auth-cache-client-ip (boolean) [false]

If enabled, a clients source IP address will also be stored in the RESTCONF authentication cache.

/ncs-config/aaa/single-sign-on/enabled (boolean) [false]

When set to 'true' Single Sign-On (SSO) functionality is enabled for NCS.
SSO is a valid authentication method for webui and JSON-RPC interfaces.
The endpoint for SSO in NCS is hardcoded to '/sso'.
The SSO functionality needs package-authentication to be enabled in order to work.

/ncs-config/aaa/single-sign-on/enable-automatic-redirect (boolean) [false]

When set to 'true' and there is only a single Authentication Package which has SSO enabled (has an SSO URL) a request to the servers root will be redirected to that URL.

/ncs-config/aaa/package-authentication/enabled (boolean) [false]

When set to 'true', package authentication is used.
The package needs to have an executable in 'scripts/authenticate' which adheres to the package authentication API in order to be used by the package authentication.

/ncs-config/aaa/package-authentication/package-challenge/enabled (boolean) [false]

When set to 'true', package challenge is used.
The package needs to have an executable in 'scripts/challenge' which adheres to the package challenge API in order to be used by the package challenge authentication.

/ncs-config/aaa/package-authentication/packages

Specifies the authentication packages to be used by the server as a whitespace separated list from the loaded authentication package names. If there are multiple packages, the order of the package names is the order they will be tried for authentication requests.

/ncs-config/aaa/package-authentication/packages/package (string)

The name of the authentication package.

/ncs-config/aaa/package-authentication/packages/display-name (string)

The display name of the authentication package.
If no display-name is set, the package name will be used.

/ncs-config/aaa/external-authentication/enabled (boolean) [false]

When set to 'true', external authentication is used.

/ncs-config/aaa/external-authentication/executable (string)

If we enable external authentication, an executable on the local host can be launched to authenticate a user. The executable will receive the username and the cleartext password on its standard input. The format is '[${USER};${PASS};]\n'. For example if user is 'bob' and password is 'secret', the executable will receive the line '[bob;secret;]' followed by a newline on its standard input. The program must parse this line.
The task of the external program, which for example could be a RADIUS client is to authenticate the user and also provide the user to groups mapping. So if 'bob' is member of the 'oper' and the 'lamers' group, the program should echo 'accept oper lamers' on its standard output. If the user fails to authenticate, the program should echo 'reject ${reason}' on its standard output.

/ncs-config/aaa/external-authentication/use-base64 (boolean) [false]

When set to 'true', ${USER} and ${PASS} in the data passed to the executable will be base64-encoded, allowing e.g. for the password to contain ';' characters. For example if user is 'bob' and password is 'secret', the executable will receive the string '[Ym9i;c2VjcmV0;]' followed by a newline.

/ncs-config/aaa/external-authentication/include-extra (boolean) [false]

When set to 'true', additional information items will be provided to the executable: source IP address and port, context, and protocol. I.e. the complete format will be '[${USER};${PASS};${IP};${PORT};${CONTEXT};${PROTO};]\n'. Example: '[bob;secret;192.168.1.1;12345;cli;ssh;]\n'.

/ncs-config/aaa/local-authentication/enabled (boolean) [true]

When set to true, NCS uses local authentication. That means that the user data kept in the aaa namespace is used to authenticate users. When set to false some other authentication mechanism such as PAM or external authentication must be used.

/ncs-config/aaa/authentication-callback/enabled (boolean) [false]

When set to true, NCS will invoke an application callback when authentication has succeeded or failed. The callback may reject an otherwise successful authentication. If the callback has not been registered, all authentication attempts will fail. See Javadoc for DpAuthCallback for the callback details.

/ncs-config/aaa/external-validation/enabled (boolean) [false]

When set to 'true', external token validation is used.

/ncs-config/aaa/external-validation/executable (string)

If we enable external token validation, an executable on the local host can be launched to validate a user. The executable will receive a cleartext token on its standard input. The format is '[${TOKEN};]\n'. For example if the token is '7ea345123', the executable will receive the string '[7ea345123;]' followed by a newline on its standard input. The program must parse this line.
The task of the external program, which for example could be a FUSION client, is to validate the token and also provide the token to user and groups mappings. Refer to the External Token Validation section of the documentation for the details of how the program should report the result back to NCS.

/ncs-config/aaa/external-validation/use-base64 (boolean) [false]

When set to true, ${TOKEN} in the data passed to the executable will be base64-encoded, allowing e.g. for the token to contain ';' characters.

/ncs-config/aaa/external-validation/include-extra (boolean) [false]

When set to true, additional information items will be provided to the executable: source IP address and port, context, and protocol. I.e. the complete format will be '[${TOKEN};${IP};${PORT};${CONTEXT};${PROTO};]\n'. Example: '[7ea345123;192.168.1.1;12345;cli;ssh;]\n'.

/ncs-config/aaa/validation-callback/enabled (boolean) [false]

When set to true, NCS will invoke an application callback when validation has succeeded or failed. The callback may reject an otherwise successful validation. If the callback has not been registered, all validation attempts will fail.

/ncs-config/aaa/external-challenge/enabled (boolean) [false]

When set to 'true', the external challenge mechanism is used.

/ncs-config/aaa/external-challenge/executable (string)

If we enable the external challenge mechanism, an executable on the local host can be launched to authenticate a user. The executable will receive a cleartext token on its standard input. The format is '[${CHALL-ID};${RESPONSE};]\n'. For example if the challenge id is '6yu125' and the response is '989yuey', the executable will receive the string '[6yu125;989yuey;]' followed by a newline on its standard input. The program must parse this line.
The task of the external program, which for example could be a RADIUS client, is to authenticate the combination of the challenge id and the response, and also provide a mapping to user and groups. Refer to the External challenge section of the AAA chapter in the User Guide for the details of how the program should report the result back to NCS.

/ncs-config/aaa/external-challenge/use-base64 (boolean) [false]

When set to true, ${CHALL-ID} and${RESPONSE} in the data passed to the executable will be base64-encoded, allowing e.g. for them to contain ';' characters.

/ncs-config/aaa/external-challenge/include-extra (boolean) [false]

When set to true, additional information items will be provided to the executable: source IP address and port, context, and protocol. I.e. the complete format will be '[${CHALL-ID};${RESPONSE};${IP};${PORT};${CONTEXT};${PROTO};]\n'. Example: '[6yu125;989yuey;192.168.1.1;12345;cli;ssh;]\n'.

/ncs-config/aaa/challenge-callback/enabled (boolean) [false]

When set to true, NCS will invoke an application callback when the challenge machanism has succeeded or failed. The callback may reject an otherwise successful authentication. If the callback has not been registered, all challenge mechnism attempts will fail.

/ncs-config/aaa/authorization/enabled (boolean) [true]

When set to false, all authorization checks are turned off, similar to the -noaaa flag in ncs_cli.

/ncs-config/aaa/authorization/callback/enabled (boolean) [false]

When set to true, NCS will invoke application callbacks for authorization. If the callbacks have not been registered, all authorization checks will be rejected. See Javadoc for DpAuthorizationCallback for the callback details.

/ncs-config/aaa/authorization/nacm-compliant (boolean) [true]

In earlier versions, NCS did not fully comply with the NACM specification: the 'module-name' leaf was required to match toplevel nodes, but it was not considered for the node being accessed. If this leaf is set to false, this non-compliant behavior remains - this setting is only provided for backward compatibility with existing rule sets, and is not recommended.

/ncs-config/aaa/namespace (string) [http://tail-f.com/ns/aaa/1.1]

If we want to move the AAA data into another userdefine namespace, we indicate that here.

/ncs-config/aaa/prefix (string) [/]

If we want to move the AAA data into another userdefined namespace, we indicate the prefix path in that namespace where the NCS AAA namespace has been mounted.

/ncs-config/aaa/action-input-rules

Configuration of NACM action input statements.

/ncs-config/aaa/action-input-rules/enabled (boolean) [false]

Allows NACM rules to be set for individual action input leafs.

/ncs-config/rollback

Settings controlling if and where rollback files are created. A rollback file contains the data required to restore the changes that were made when the rollback was created.

/ncs-config/rollback/enabled (boolean) [false]

When set to true a rollback file will be created whenever the running configuration is modified.

/ncs-config/rollback/directory (string)

This parameter is mandatory.
Location where rollback files will be created.

/ncs-config/rollback/history-size (uint32) [35]

Number of old rollback files to save.

/ncs-config/checkpoint

Configurations for creating transaction checkpoints in the concurrency model.

/ncs-config/checkpoint/max-write-set-size (uint32 | infinity) [128]

Maximum size of a write set in Megabytes

/ncs-config/checkpoint/max-read-set-size (uint32 | infinity) [128]

Maximum size of a read set in Megabytes

/ncs-config/checkpoint/total-size-limit (uint32 | infinity) [infinity]

Total size limit of read and write set in Megabytes.

/ncs-config/ssh

This section defines settings which affect the behavior of the SSH server built into NCS.

/ncs-config/ssh/idle-connection-timeout (xs:duration) [PT10M]

The maximum time that an authenticated connection to the SSH server is allowed to exist without open channels. If the timeout is reached, the SSH server closes the connection. Default is PT10M, i.e. 10 minutes. If the value is 0, there is no timeout.

/ncs-config/ssh/algorithms

This section defines custom lists of algorithms to be usable with the built-in SSH implementation.
For each type of algorithm, an empty value means that all supported algorithms should be usable, and a non-empty value (a comma-separated list of algorithm names) means that the intersection of the supported algorithms and the configured algorithms should be usable.

/ncs-config/ssh/algorithms/server-host-key (string) [ssh-ed25519,ecdsa-sha2-nistp256]

The supported serverHostKey algorithms (if implemented in libcrypto) are "ecdsa-sha2-nistp521", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp256", "ssh-ed25519", "ssh-rsa", "rsa-sha2-256", "rsa-sha2-512" and "ssh-dss" but for any SSH server, it is limited to those algorithms for which there is a host key installed in the directory given by /ncs-config/aaa/ssh-server-key-dir.
To limit the usable serverHostKey algorithms to "ssh-dss", set this value to "ssh-dss" or avoid installing a key of any other type than ssh-dss in the sshServerKeyDir.

/ncs-config/ssh/algorithms/kex (string) [curve25519-sha256,ecdh-sha2-nistp256,diffie-hellman-group14-sha256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256]

The supported key exchange algorithms (as long as their hash functions are implemented in libcrypto) are "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "curve25519-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256".
To limit the usable key exchange algorithms to "diffie-hellman-group14-sha1" and "diffie-hellman-group14-sha256" (in that order) set this value to "diffie-hellman-group14-sha1, diffie-hellman-group14-sha256".

/ncs-config/ssh/algorithms/dh-group