System Settings

Introduction

The system settings under the configuration context can be used to set general information about the device, such as hostname, timezone, and other system-wide settings.

To enter the system settings context:

example:/#> configure
example:/config/#> system
example:/config/system/#>

Configuration

Hostname

The system hostname is used to identify the device in a network. It can be configured in the CLI as shown in the example below.

example:/#> configure
example:/config/#> system
example:/config/system/#> hostname bob
example:/config/system/#> leave
bob:/#>

The set of allowed characters follows the specification defined in RFC 1123. This includes letters (a-z, A-Z), digits (0-9) and hyphens (-). Additionally, underscores (_) are also allowed. The hostname cannot start or end with a hyphen or underscore, and cannot exceed 63 characters.

[no] hostname [HOSTNAME]

Description

System hostname.

Options

Option	Description
no	Reset to the default hostname.
HOSTNAME	Hostname string (1..63 characters). RFC 1123 compliant. Allowed characters are: Letters (A-Z, a-z), numbers (0-9), dash (-), and underscore (_). Hostname may not start or end with dash (-) or underscore (_).

Domain Name

The system domain name is used in conjunction with the hostname to form the fully qualified domain name (FQDN) of the device. The domain name can be configured as shown in the example below.

example:/#> configure
example:/config/#> system
example:/config/system/#> domain example.com
example:/config/system/#> leave
example:/#>

Setting the system domain name has the following practical effects:

• The domain name is added to the default search domain for DNS resolution. This means that when a user tries to resolve a hostname without a domain, the system will automatically append the configured domain name and attempt to resolve it. For example, if the domain is set to example.com and a user tries to resolve host1, the system will additionally attempt to resolve host1.example.com. This is true for both local name resolution, as well as if the system is configured as a DNS resolver for other devices on the network.
• DNS records for the local device will include the domain. Because of this, reverse resolution of the device's IP address will return the FQDN. As an implementation note, the device FQDN is added to the record for the IP address 127.0.1.1 in the local DNS resolver configuration.
• If the system is configured to use the FQDN for syslog messages, the domain name will be included in the hostname part of the syslog messages, as described in RFC 5424. See the logging configuration documentation for more details.
• The host and domain names are configured in the underlying Linux system. For instance, if applications use the getaddrinfo() system call, or the dnsdomainname command in the shell, they will return the configured hostname and domain name.

note

The above is specific to the static configuration of the system domain name. If the device is configured to obtain its hostname and/or domain name dynamically via one or more DHCP leases, only the first and second points will apply. Host and domain names obtained via DHCP will be added to the local DNS configuration, but they will not be used in syslog messages.

[no] domain [DOMAIN]

Description

System domain name.

Options

Option	Description
no	Remove any configured system domain name.
DOMAIN	Domain name string (1..63 characters). Allowed characters are letters (A-Z, a-z), numbers (0-9), dash (-), and dot (.). Domain name must not start or end with a dash (-) or dot (.).

Description

The system description provides a brief text describing the device or its role in the network.

example:/config/system/#> description "Main office router"

[no] description [DESCRIPTION]

Description

System description.

Options

Option	Description
no	Reset to the default description.
DESCRIPTION	Description text.

Location

The system location describes where the device is physically located.

example:/config/system/#> location "Rack 5, Room 101, Building A"

[no] location [LOCATION]

Description

Location of the system.

Options

Option	Description
no	Remove the configured location.
LOCATION	Location text.

Contact

The contact information for the system. It is typically used to specified an email address or the name of the person responsible for maintaining the device.

example:/config/system/#> contact "admin@example.com"

[no] contact [EMAIL]

Description

Contact information for the system.

Options

Option	Description
no	Remove the configured contact information.
EMAIL	Contact text (e.g., email address).

Message of the Day (MOTD)

The message of the day (MOTD) is a banner displayed when a user logs in. This can be used to display policy information, warnings, or any other message for users accessing the device.

example:/config/system/#> motd "Welcome to the network gateway.\nContact admin@example.com for support."

For flexible formatting, certain control characters are allowed:

Control Character	Description
\a	BELL
\b	Backspace
\t	Horizontal TAB
\n	New line
\v	Vertical TAB
\f	Form Feed
\r	Carriage Return
\e	ANSI escape
\\	Backslash

[no] motd [MESSAGE]

Description

System postlogin message.

Options

Option	Description
no	Reset to the default message.
MESSAGE	Message text, enclosed in quotes.

Timezone

The timezone setting controls the local time displayed by the device. Daylight saving time (DST) adjustments are applied automatically based on the selected timezone.

The timezone can be configured as below:

example:/config/system/#> show timezone Europe
Europe/Amsterdam
Europe/Berlin
Europe/London
Europe/Stockholm
...
example:/config/system/#> timezone Europe/Stockholm

[no] timezone <timezone> [no-dst]

Description

System timezone.

Options

Option	Description
no	Reset to the default timezone (UTC).
timezone	A valid timezone identifier (e.g., Europe/Stockholm)
no-dst	Disable daylight saving time adjustments

list-timezones

Description

List all available timezones

SSL Security Level

The SSL security level sets a system-wide floor for the cryptographic strength accepted in TLS connections. It is applied by OpenSSL and restricts key sizes, signature algorithms, protocol versions and cipher suites. Raising the level therefore reduces the set of cipher suites that can be selected, for example for an LDAP remote server.

example:/#> configure
example:/config/#> system
example:/config/system/#> ssl-security-level 3
example:/config/system/#> leave

Important

Raise the level with care. From level 3 and upwards RSA, DSA and DH keys shorter than 3072 bits are rejected, and level 4 and 5 raise that bar to 7680 and 15360 bits respectively. Certificates that WeOS generates itself, such as the self-signed certificate the Web server uses for HTTPS by default, are RSA 2048 and are therefore not accepted at those levels. Before selecting level 3 or higher, make sure every certificate involved, on the device as well as on the peer, is strong enough, otherwise the affected connections will fail to establish.

[no] ssl-security-level <NUMBER>

Description

System-wide SSL security level. Default is 2.

Options

Option	Description
no	Reset to the default security level (2).
NUMBER	Security level, 1 to 5.
Level 1 (weak)	The security level corresponds to a minimum of 80 bits of security. Any parameters offering below 80 bits of security are excluded. As a result RSA, DSA and DH keys shorter than 1024 bits and ECC keys shorter than 160 bits are prohibited. Any cipher suite using MD5 for the MAC is also prohibited. Any cipher suites using CCM with a 64 bit authentication tag are prohibited. Note that signatures using SHA1 and MD5 are also forbidden at this level as they have less than 80 security bits. Additionally, SSLv3, TLS 1.0, TLS 1.1 and DTLS 1.0 are all disabled at this level.
Level 2 (default)	Security level set to 112 bits of security. As a result RSA, DSA and DH keys shorter than 2048 bits and ECC keys shorter than 224 bits are prohibited. In addition to the level 1 exclusions any cipher suite using RC4 is also prohibited. Compression is disabled.
Level 3 (strong)	Security level set to 128 bits of security. As a result RSA, DSA and DH keys shorter than 3072 bits and ECC keys shorter than 256 bits are prohibited. In addition to the level 2 exclusions cipher suites not offering forward secrecy are prohibited. Session tickets are disabled.
Level 4 (highly restrictive)	Security level set to 192 bits of security. As a result RSA, DSA and DH keys shorter than 7680 bits and ECC keys shorter than 384 bits are prohibited. Cipher suites using SHA1 for the MAC are prohibited.
Level 5 (extreme hardening)	Security level set to 256 bits of security. As a result RSA, DSA and DH keys shorter than 15360 bits and ECC keys shorter than 512 bits are prohibited.