2 namespace "urn:ietf:params:xml:ns:yang:ietf-system";
5 import ietf-yang-types {
9 import ietf-inet-types {
13 import ietf-netconf-acm {
17 import iana-crypt-hash {
22 "IETF NETMOD (NETCONF Data Modeling Language) Working Group";
25 "WG Web: <http://tools.ietf.org/wg/netmod/>
26 WG List: <mailto:netmod@ietf.org>
28 WG Chair: Thomas Nadeau
29 <mailto:tnadeau@lucidvision.com>
31 WG Chair: Juergen Schoenwaelder
32 <mailto:j.schoenwaelder@jacobs-university.de>
35 <mailto:andy@yumaworks.com>
37 Editor: Martin Bjorklund
38 <mailto:mbj@tail-f.com>";
41 "This module contains a collection of YANG definitions for the
42 configuration and identification of some common system
43 properties within a device containing a NETCONF server. This
44 includes data node definitions for system identification,
45 time-of-day management, user management, DNS resolver
46 configuration, and some protocol operations for system
49 Copyright (c) 2014 IETF Trust and the persons identified as
50 authors of the code. All rights reserved.
52 Redistribution and use in source and binary forms, with or
53 without modification, is permitted pursuant to, and subject
54 to the license terms contained in, the Simplified BSD License
55 set forth in Section 4.c of the IETF Trust's Legal Provisions
56 Relating to IETF Documents
57 (http://trustee.ietf.org/license-info).
59 This version of this YANG module is part of RFC 7317; see
60 the RFC itself for full legal notices.";
66 "RFC 7317: A YANG Data Model for System Management";
73 typedef timezone-name {
76 "A time zone name as used by the Time Zone Database,
77 sometimes referred to as the 'Olson Database'.
79 The exact set of valid values is an implementation-specific
80 matter. Client discovery of the exact set of time zone names
81 for a particular server is out of scope.";
83 "RFC 6557: Procedures for Maintaining the Time Zone Database";
92 "Indicates that the device can be configured as a RADIUS
95 "RFC 2865: Remote Authentication Dial In User Service (RADIUS)";
98 feature authentication {
100 "Indicates that the device supports configuration of
101 user authentication.";
104 feature local-users {
105 if-feature authentication;
107 "Indicates that the device supports configuration of
108 local user authentication.";
111 feature radius-authentication {
113 if-feature authentication;
115 "Indicates that the device supports configuration of user
116 authentication over RADIUS.";
118 "RFC 2865: Remote Authentication Dial In User Service (RADIUS)
119 RFC 5607: Remote Authentication Dial-In User Service (RADIUS)
120 Authorization for Network Access Server (NAS)
126 "Indicates that the device can be configured to use one or
127 more NTP servers to set the system date and time.";
130 feature ntp-udp-port {
133 "Indicates that the device supports the configuration of
134 the UDP port for NTP servers.
136 This is a 'feature', since many implementations do not support
137 any port other than the default port.";
140 feature timezone-name {
142 "Indicates that the local time zone on the device
143 can be configured to use the TZ database
144 to set the time zone and manage daylight saving time.";
146 "RFC 6557: Procedures for Maintaining the Time Zone Database";
149 feature dns-udp-tcp-port {
151 "Indicates that the device supports the configuration of
152 the UDP and TCP port for DNS servers.
154 This is a 'feature', since many implementations do not support
155 any port other than the default port.";
163 identity authentication-method {
165 "Base identity for user authentication methods.";
169 base authentication-method;
171 "Indicates user authentication using RADIUS.";
173 "RFC 2865: Remote Authentication Dial In User Service (RADIUS)
174 RFC 5607: Remote Authentication Dial-In User Service (RADIUS)
175 Authorization for Network Access Server (NAS)
179 identity local-users {
180 base authentication-method;
182 "Indicates password-based authentication of locally
186 identity radius-authentication-type {
188 "Base identity for RADIUS authentication types.";
191 identity radius-pap {
192 base radius-authentication-type;
194 "The device requests Password Authentication Protocol (PAP)
195 authentication from the RADIUS server.";
197 "RFC 2865: Remote Authentication Dial In User Service (RADIUS)";
200 identity radius-chap {
201 base radius-authentication-type;
203 "The device requests Challenge Handshake Authentication
204 Protocol (CHAP) authentication from the RADIUS server.";
206 "RFC 2865: Remote Authentication Dial In User Service (RADIUS)";
210 * Configuration data nodes
215 "System group configuration.";
220 "The administrator contact information for the system.
222 A server implementation MAY map this leaf to the sysContact
223 MIB object. Such an implementation needs to use some
224 mechanism to handle the differences in size and characters
225 allowed between this leaf and sysContact. The definition of
226 such a mechanism is outside the scope of this document.";
228 "RFC 3418: Management Information Base (MIB) for the
229 Simple Network Management Protocol (SNMP)
230 SNMPv2-MIB.sysContact";
233 type inet:domain-name;
235 "The name of the host. This name can be a single domain
236 label or the fully qualified domain name of the host.";
241 "The system location.
243 A server implementation MAY map this leaf to the sysLocation
244 MIB object. Such an implementation needs to use some
245 mechanism to handle the differences in size and characters
246 allowed between this leaf and sysLocation. The definition
247 of such a mechanism is outside the scope of this document.";
249 "RFC 3418: Management Information Base (MIB) for the
250 Simple Network Management Protocol (SNMP)
251 SNMPv2-MIB.sysLocation";
256 "Configuration of the system date and time properties.";
260 "The system time zone information.";
263 if-feature timezone-name;
267 "The TZ database name to use for the system, such
268 as 'Europe/Stockholm'.";
271 case timezone-utc-offset {
272 leaf timezone-utc-offset {
274 range "-1500 .. 1500";
278 "The number of minutes to add to UTC time to
279 identify the time zone for this system. For example,
280 'UTC - 8:00 hours' would be represented as '-480'.
281 Note that automatic daylight saving time adjustment
282 is not provided if this object is used.";
291 "Enables the NTP client unless the 'enabled' leaf
292 (which defaults to 'true') is set to 'false'";
294 "Configuration of the NTP client.";
300 "Indicates that the system should attempt to
301 synchronize the system clock with an NTP server
302 from the 'ntp/server' list.";
307 "List of NTP servers to use for system clock
308 synchronization. If '/system/ntp/enabled'
309 is 'true', then the system will attempt to
310 contact and utilize the specified NTP servers.";
315 "An arbitrary name for the NTP server.";
320 "The transport-protocol-specific parameters for this
326 "Contains UDP-specific configuration parameters
332 "The address of the NTP server.";
335 if-feature ntp-udp-port;
336 type inet:port-number;
339 "The port number of the NTP server.";
344 leaf association-type {
348 "Use client association mode. This device
349 will not provide synchronization to the
350 configured NTP server.";
354 "Use symmetric active association mode.
355 This device may provide synchronization
356 to the configured NTP server.";
360 "Use client association mode with one or
361 more of the NTP servers found by DNS
362 resolution of the domain name given by
363 the 'address' leaf. This device will not
364 provide synchronization to the servers.";
369 "The desired association type for this NTP server.";
375 "Indicates whether this server should enable burst
376 synchronization or not.";
382 "Indicates whether this server should be preferred
388 container dns-resolver {
390 "Configuration of the DNS resolver.";
393 type inet:domain-name;
396 "An ordered list of domains to search when resolving
403 "List of the DNS servers that the resolver should query.
405 When the resolver is invoked by a calling application, it
406 sends the query to the first name server in this list. If
407 no response has been received within 'timeout' seconds,
408 the resolver continues with the next server in the list.
409 If no response is received from any server, the resolver
410 continues with the first server again. When the resolver
411 has traversed the list 'attempts' times without receiving
412 any response, it gives up and returns an error to the
415 Implementations MAY limit the number of entries in this
421 "An arbitrary name for the DNS server.";
426 "The transport-protocol-specific parameters for this
430 container udp-and-tcp {
432 "Contains UDP- and TCP-specific configuration
433 parameters for DNS.";
435 "RFC 1035: Domain Names - Implementation and
437 RFC 5966: DNS Transport over TCP - Implementation
441 type inet:ip-address;
444 "The address of the DNS server.";
447 if-feature dns-udp-tcp-port;
448 type inet:port-number;
451 "The UDP and TCP port number of the DNS server.";
459 "Resolver options. The set of available options has been
460 limited to those that are generally available across
461 different resolver implementations and generally useful.";
469 "The amount of time the resolver will wait for a
470 response from each remote name server before
471 retrying the query via a different name server.";
479 "The number of times the resolver will send a query to
480 all of its name servers before giving up and returning
481 an error to the calling application.";
490 "Configuration of the RADIUS client.";
496 "List of RADIUS servers used by the device.
498 When the RADIUS client is invoked by a calling
499 application, it sends the query to the first server in
500 this list. If no response has been received within
501 'timeout' seconds, the client continues with the next
502 server in the list. If no response is received from any
503 server, the client continues with the first server again.
504 When the client has traversed the list 'attempts' times
505 without receiving any response, it gives up and returns an
506 error to the calling application.";
511 "An arbitrary name for the RADIUS server.";
516 "The transport-protocol-specific parameters for this
522 "Contains UDP-specific configuration parameters
528 "The address of the RADIUS server.";
531 leaf authentication-port {
532 type inet:port-number;
535 "The port number of the RADIUS server.";
540 nacm:default-deny-all;
542 "The shared secret, which is known to both the
543 RADIUS client and server.";
545 "RFC 2865: Remote Authentication Dial In User
551 leaf authentication-type {
553 base radius-authentication-type;
557 "The authentication type requested from the RADIUS
563 "RADIUS client options.";
572 "The number of seconds the device will wait for a
573 response from each RADIUS server before trying with a
583 "The number of times the device will send a query to
584 all of its RADIUS servers before giving up.";
589 container authentication {
590 nacm:default-deny-write;
591 if-feature authentication;
594 "The authentication configuration subtree.";
596 leaf-list user-authentication-order {
598 base authentication-method;
600 must '(. != "sys:radius" or ../../radius/server)' {
602 "When 'radius' is used, a RADIUS server"
603 + " must be configured.";
605 "When 'radius' is used as an authentication method,
606 a RADIUS server must be configured.";
611 "When the device authenticates a user with a password,
612 it tries the authentication methods in this leaf-list in
613 order. If authentication with one method fails, the next
614 method is used. If no method succeeds, the user is
617 An empty user-authentication-order leaf-list still allows
618 authentication of users using mechanisms that do not
621 If the 'radius-authentication' feature is advertised by
622 the NETCONF server, the 'radius' identity can be added to
625 If the 'local-users' feature is advertised by the
626 NETCONF server, the 'local-users' identity can be
627 added to this list.";
631 if-feature local-users;
634 "The list of local users configured on this device.";
639 "The user name string identifying this entry.";
642 type ianach:crypt-hash;
644 "The password for this entry.";
646 list authorized-key {
649 "A list of public SSH keys for this user. These keys
650 are allowed for SSH authentication, as described in
653 "RFC 4253: The Secure Shell (SSH) Transport Layer
659 "An arbitrary name for the SSH key.";
666 "The public key algorithm name for this SSH key.
668 Valid values are the values in the IANA 'Secure Shell
669 (SSH) Protocol Parameters' registry, Public Key
672 "IANA 'Secure Shell (SSH) Protocol Parameters'
673 registry, Public Key Algorithm Names";
679 "The binary public key data for this SSH key, as
680 specified by RFC 4253, Section 6.6, i.e.:
682 string certificate or public key format
684 byte[n] key/certificate data.";
686 "RFC 4253: The Secure Shell (SSH) Transport Layer
695 * Operational state data nodes
698 container system-state {
701 "System group operational state.";
705 "Contains vendor-specific information for
706 identifying the system platform and operating system.";
708 "IEEE Std 1003.1-2008 - sys/utsname.h";
713 "The name of the operating system in use -
714 for example, 'Linux'.";
716 "IEEE Std 1003.1-2008 - utsname.sysname";
721 "The current release level of the operating
722 system in use. This string MAY indicate
723 the OS source code revision.";
725 "IEEE Std 1003.1-2008 - utsname.release";
730 "The current version level of the operating
731 system in use. This string MAY indicate
732 the specific OS build date and target variant
735 "IEEE Std 1003.1-2008 - utsname.version";
740 "A vendor-specific identifier string representing
741 the hardware in use.";
743 "IEEE Std 1003.1-2008 - utsname.machine";
749 "Monitoring of the system date and time properties.";
751 leaf current-datetime {
752 type yang:date-and-time;
754 "The current system date and time.";
759 type yang:date-and-time;
761 "The system date and time when the system last restarted.";
766 rpc set-current-datetime {
767 nacm:default-deny-all;
769 "Set the /system-state/clock/current-datetime leaf
770 to the specified value.
772 If the system is using NTP (i.e., /system/ntp/enabled
773 is set to 'true'), then this operation will fail with
774 error-tag 'operation-failed' and error-app-tag value of
777 leaf current-datetime {
778 type yang:date-and-time;
781 "The current system date and time.";
787 nacm:default-deny-all;
789 "Request that the entire system be restarted immediately.
790 A server SHOULD send an rpc reply to the client before
791 restarting the system.";
794 rpc system-shutdown {
795 nacm:default-deny-all;
797 "Request that the entire system be shut down immediately.
798 A server SHOULD send an rpc reply to the client before
799 shutting down the system.";