Add OPNsense SSH shell access and Unbound management endpoints

Browse Source

Paramiko exec_command() bypasses the OPNsense console menu automatically
(menu only appears for interactive logins) so no human needs to press 8.

New API surface:
  POST /api/opnsense/ssh/generate-key        — create ed25519 key for OPNsense
  POST /api/opnsense/configure-ssh           — save SSH settings + pin host key
  GET  /api/opnsense/ssh-status              — test SSH connectivity
  POST /api/opnsense/ssh/run                 — run arbitrary command (auth-gated)
  GET  /api/opnsense/unbound/status          — read config files + .lan leak test
  POST /api/opnsense/unbound/reload          — unbound-control reload
  POST /api/opnsense/unbound/fix-lan-zone    — write correct local-lan-zone.conf,
                                               verify with unbound-checkconf,
                                               reload, confirm no ControlD leak
  POST /api/opnsense/unbound/write-forward-ctrld — enable/disable ctrld forwarding

SSH key stored at /etc/switch-manager/opnsense_key
Host key pinned to /etc/switch-manager/opnsense_known_hosts
SSH config (key_path, ssh_user) stored alongside existing API creds in opnsense.json

https://claude.ai/code/session_01JR2EMK7rwrZJowpstcaxQ6

...

This commit is contained in:

Claude

2026-03-24 18:43:02 +00:00

parent 8a3ef94310

commit d9b6d05862

2 changed files with 301 additions and 2 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

Avaya_5952_setup.py

+2 -2

File diff suppressed because one or more lines are too long