<?xml version="1.0" encoding="UTF-8"?>
<!--
Device:2 Root Data Model: Common Object definitions [SSH]

Copyright (c) 2021-2024, Broadband Forum

Redistribution and use in source and binary forms, with or
without modification, are permitted provided that the following
conditions are met:

1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above
copyright notice, this list of conditions and the following
disclaimer in the documentation and/or other materials
provided with the distribution.

3. Neither the name of the copyright holder nor the names of its
contributors may be used to endorse or promote products
derived from this software without specific prior written
permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

The above license is used as a license under copyright only.
Please reference the Forum IPR Policy for patent licensing terms
<https://www.broadband-forum.org/ipr-policy>.

Any moral rights which are necessary to exercise under the above
license grant are also deemed granted under this license.

Comments or questions about this Broadband Forum data model should be
directed to <info@broadband-forum.org>.
-->

<dm:document
  xmlns:dm="urn:broadband-forum-org:cwmp:datamodel-1-10"
  xmlns:dmr="urn:broadband-forum-org:cwmp:datamodel-report-1-0"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="
  urn:broadband-forum-org:cwmp:datamodel-1-10
  https://www.broadband-forum.org/cwmp/cwmp-datamodel-1-10.xsd
  urn:broadband-forum-org:cwmp:datamodel-report-1-0
  https://www.broadband-forum.org/cwmp/cwmp-datamodel-report-1-0.xsd"
  spec="urn:broadband-forum-org:tr-181-2-20-0-ssh"
  file="tr-181-2-20-0-ssh.xml">

  <import file="tr-069-biblio.xml" spec="urn:broadband-forum-org:tr-069"/>

  <import file="tr-106-types.xml" spec="urn:broadband-forum-org:tr-106">
    <component name="Alias"/>
    <dataType name="IPAddress"/>
  </import>

  <import file="tr-181-2-root.xml"
    spec="urn:broadband-forum-org:tr-181-2-20-root">
    <component name="Root"/>
  </import>

  <import file="tr-181-2-ip.xml"
      spec="urn:broadband-forum-org:tr-181-2-20-ip">
    <component name="IPAccessControl"/>
  </import>

  <component name="SSH">
    <object name="Device.SSH." access="readOnly" minEntries="1" maxEntries="1"
      version="2.16">
      <description>
        This object contains global parameters relating to the Secure Shell
        clients and or servers implementations that are active in the CPE.
      </description>

      <parameter name="Enable" access="readWrite">
        <description>
          Enables or disables the SSH service.
        </description>
        <syntax>
          <boolean/>
        </syntax>
      </parameter>

      <parameter name="Status" access="readOnly">
        <description>
          The status of the SSH service. {{enum}}
        </description>
        <syntax>
          <string>
            <enumeration value="Disabled">
              <description>
                Indicates that the SSH service is disabled.
              </description>
            </enumeration>
            <enumeration value="Enabled">
              <description>
                Indicates that the SSH service is enabled.
              </description>
            </enumeration>
            <enumeration value="Error" optional="true">
              <description>
                Indicates that the SSH service has encountered an error.
              </description>
            </enumeration>
          </string>
        </syntax>
      </parameter>

      <parameter name="ServerNumberOfEntries" access="readOnly">
        <description>
          {{numentries}}
        </description>
        <syntax>
          <unsignedInt/>
        </syntax>
      </parameter>

      <parameter name="AuthorizedKeyNumberOfEntries" access="readOnly">
        <description>
          {{numentries}}
        </description>
        <syntax>
          <unsignedInt/>
        </syntax>
      </parameter>
    </object>

    <object name="Device.SSH.Server.{i}." access="readWrite"
      numEntriesParameter="ServerNumberOfEntries" minEntries="0"
      maxEntries="unbounded" version="2.16">
      <description>
        This object contains parameters relating to a SSH server instance.
      </description>
      <uniqueKey functional="false">
        <parameter ref="Alias"/>
      </uniqueKey>

      <parameter name="Enable" access="readWrite">
        <description>
          Enables or disables the SSH server instance. When {{param}} is set to
          {{false}}, any active sessions must be forcibly terminated and the
          {{param|ActivationDate}} is reset.
        </description>
        <syntax>
          <boolean/>
        </syntax>
      </parameter>
      <parameter name="Status" access="readOnly">
        <description>
          The status of the SSH server instance. {{enum}}
        </description>
        <syntax>
          <string>
            <enumeration value="Disabled">
              <description>
                Indicates that the SSH server instance is disabled.
              </description>
            </enumeration>
            <enumeration value="Enabled">
              <description>
                Indicates that the SSH server instance is enabled.
              </description>
            </enumeration>
            <enumeration value="Error" optional="true">
              <description>
                Indicates that the SSH server instance has encountered an
                error.
              </description>
            </enumeration>
            <enumeration value="Error_Misconfigured">
              <description>
                Indicates that a necessary configuration value is undefined or
                invalid.
              </description>
            </enumeration>
          </string>
        </syntax>
      </parameter>

      <component ref="Alias"/>

      <parameter name="Interface" access="readWrite">
        <description>
          The IP Interface associated with the {{object}} entry.

          If {{empty}} is specified, the service should listen on all interfaces.
        </description>
        <syntax>
          <string>
            <size maxLength="256"/>
            <pathRef refType="strong" targetParent=".IP.Interface."
              targetType="row"/>
            </string>
            <default type="object" value=""/>
          </syntax>
        </parameter>

        <parameter name="Port" access="readWrite">
          <description>
            Specify the port used by the SSH server.
          </description>
          <syntax>
            <unsignedInt>
              <range minInclusive="1" maxInclusive="65535"/>
            </unsignedInt>
            <default type="object" value="22"/>
          </syntax>
        </parameter>

        <parameter name="IdleTimeout" access="readWrite">
          <description>
            When the session is inactive, it is automatically terminated after
            {{param}} amount of {{units}}. A value of ''0'' disables this
            feature.
          </description>
          <syntax>
            <unsignedInt>
              <units value="seconds"/>
            </unsignedInt>
            <default type="object" value="180"/>
          </syntax>
        </parameter>

        <parameter name="KeepAlive" access="readWrite">
          <description>
            Every amount of {{param}} {{units}} a keep alive message is sent. A
            value of ''0'' disables this feature.
          </description>
          <syntax>
            <unsignedInt>
              <units value="seconds"/>
            </unsignedInt>
            <default type="object" value="300"/>
          </syntax>
        </parameter>

        <parameter name="AllowRootLogin" access="readWrite">
          <description>
            Permit SSH users to login as root.
          </description>
          <syntax>
            <boolean/>
            <default type="object" value="false"/>
          </syntax>
        </parameter>

        <parameter name="AllowPasswordLogin" access="readWrite">
          <description>
            Permit SSH users to login using a password.
          </description>
          <syntax>
            <boolean/>
            <default type="object" value="false"/>
          </syntax>
        </parameter>

        <parameter name="AllowRootPasswordLogin" access="readWrite">
          <description>
            Permit the root SSH user to login using a password.
          </description>
          <syntax>
            <boolean/>
            <default type="object" value="false"/>
          </syntax>
        </parameter>

        <parameter name="MaxAuthTries" access="readWrite">
          <description>
            Maximum authentication tries allowed before disconnect
          </description>
          <syntax>
            <unsignedInt/>
            <default type="object" value="3"/>
          </syntax>
        </parameter>

        <parameter name="BanTime" access="readWrite" version="2.20">
          <description>
            The time, in {{units}}, that an IP address is banned after exceeding
            the {{param|MaxAuthTries}}. A value of ''0'' disables this feature.
          </description>
          <syntax>
            <unsignedInt>
              <units value="seconds"/>
            </unsignedInt>
            <default type="object" value="900"/>
          </syntax>
        </parameter>

        <component ref="IPAccessControl"/>

        <parameter name="ActivationDate" access="readOnly">
          <description>
            Activation date indicates when the server instance has been activated
            and the {{param|Enable}} is set to {{true}}.
          </description>
          <syntax>
            <dateTime/>
          </syntax>
        </parameter>

        <parameter name="AutoDisableDuration" access="readWrite">
          <description>
            The SSH server instance will be disabled when the the {{param}}
            elapses, and configuration must be done in {{units}}. At the end, the
            coressponding {{param|Enable}} parameter of the SSH server instance
            is automatically changed to false {{false}}. Any active sessions must
            be forcibly terminated. 0 means the the SSH server instance is always
            active.
          </description>
          <syntax>
            <unsignedInt>
              <units value="minutes"/>
            </unsignedInt>
            <default type="object" value="0"/>
          </syntax>
        </parameter>

        <parameter name="PID" access="readOnly">
          <description>
            Current Process Identifier of the SSH server instance.

            Note: This parameter was demoted to readOnly in the Device:2.18 version.
          </description>
          <syntax>
            <unsignedInt/>
            <default type="object" value="0"/>
          </syntax>
        </parameter>

        <parameter name="UserGroupAccess" access="readWrite" version="2.19">
          <description>
            Restricts access to the SSH server instance to the given user group.
            When {{empty}}, everyone has access.
          </description>
          <syntax>
            <string>
              <pathRef refType="weak" targetParent=".Users.Group." targetType="row"/>
            </string>
            <default type="object" value=""/>
          </syntax>
        </parameter>

        <parameter name="SessionNumberOfEntries" access="readOnly">
          <description>
            {{numentries}}
          </description>
          <syntax>
            <unsignedInt/>
          </syntax>
        </parameter>

        <parameter name="MaxAccessLogEntries" access="readWrite" version="2.19">
          <description>
            The maximum number of entries available in the {{object|AccessLog}} table.
            Defines the maximum number of {{object|AccessLog}} instances that can be stored on the device.

            When the maximum {{object|AccessLog}} entries as indicated by {{param}} are reached,
            the next boot entry overrides the object with the oldest {{param|AccessLog.{i}.TimeStamp}}.

            Set this parameter to 0 to completely disable the creation of {{object|AccessLog}} instances.

            Set this parameter to -1 to leave it open to the implementation to decide
            the maximum number of {{object|AccessLog}} instances that may be stored on the device.

            Reducing the {{param}} will cause for the implementation to delete the oldest {{object|AccessLog}} instances.

            This setting does not affect the counting of access logs.
          </description>
          <syntax>
            <int>
              <range minInclusive="-1"/>
            </int>
          </syntax>
        </parameter>

        <parameter name="AccessLogNumberOfEntries" access="readOnly" version="2.19">
          <description/>
          <syntax>
            <unsignedInt/>
          </syntax>
        </parameter>
      </object>

      <object name="Device.SSH.Server.{i}.Session.{i}." access="readOnly"
        numEntriesParameter="SessionNumberOfEntries" minEntries="0"
        maxEntries="unbounded" version="2.16">
        <description>
          Active SSH session list.
        </description>
        <uniqueKey functional="false">
          <parameter ref="Alias"/>
        </uniqueKey>

        <component ref="Alias"/>

        <parameter name="User" access="readOnly">
          <description>
            The user to whom the session belongs to.

            Note: This parameter was demoted to readOnly in the Device:2.18 version.
          </description>
          <syntax>
            <string>
              <size maxLength="256"/>
              <pathRef refType="strong" targetParent=".Users.User."
                targetType="row"/>
              </string>
            </syntax>
          </parameter>

          <parameter name="IPAddress" access="readOnly">
            <description>
              IP address of the remote SSH client.
            </description>
            <syntax>
              <dataType ref="IPAddress"/>
            </syntax>
          </parameter>

          <parameter name="Port" access="readOnly">
            <description>
              Port of the remote SSH client.
            </description>
            <syntax>
              <unsignedInt/>
            </syntax>
          </parameter>
        </object>

        <object name="Device.SSH.AuthorizedKey.{i}." access="readWrite"
          numEntriesParameter="AuthorizedKeyNumberOfEntries" minEntries="0"
          maxEntries="unbounded" version="2.16">
          <description>
            This object contains parameters relating to a SSH server instance.
          </description>
          <uniqueKey functional="false">
            <parameter ref="Alias"/>
          </uniqueKey>

          <component ref="Alias"/>

          <parameter name="User" access="readWrite">
            <description>
              The user to whom the authorized key belongs to.
            </description>
            <syntax>
              <string>
                <size maxLength="256"/>
                <pathRef refType="strong" targetParent=".Users.User."
                  targetType="row"/>
                </string>
                <default type="object" value=""/>
              </syntax>
            </parameter>

            <parameter name="Key" access="readWrite">
              <description>
                Public key used for authentication (OpenSSH format).
              </description>
              <syntax>
                <string/>
              </syntax>
            </parameter>
          </object>

          <object name="Device.SSH.Server.{i}.AccessLog.{i}." access="readOnly"
            minEntries="0" maxEntries="unbounded"
            numEntriesParameter="AccessLogNumberOfEntries" version="2.19">
            <description>
              This table logs each SSH login attempt made on the device.

              When the number of entries reaches the maximum specified by {{param|#.MaxAccessLogEntries}},
              the oldest entry (determined by {{param|TimeStamp}}) will be deleted and a new entry will be created for the newest login attempt.
            </description>

            <uniqueKey functional="false">
              <parameter ref="Alias"/>
            </uniqueKey>

            <component ref="Alias"/>

            <parameter name="TimeStamp" access="readOnly">
              <description>
                The date and time when the SSH login attempt occurred.
              </description>
              <syntax>
                <dateTime/>
              </syntax>
            </parameter>

            <parameter name="User" access="readOnly">
              <description>
                The username provided during the SSH access attempt.
              </description>
              <syntax>
                <string/>
              </syntax>
            </parameter>

            <parameter name="IPAddress" access="readOnly">
              <description>
                The IP address of the client that attempted to access the SSH server.
              </description>
              <syntax>
                <dataType ref="IPAddress"/>
              </syntax>
            </parameter>

            <parameter name="Port" access="readOnly">
              <description>
                The port number of the client that attempted to access the SSH server.
              </description>
              <syntax>
                <unsignedInt/>
              </syntax>
            </parameter>

            <parameter name="Status" access="readOnly">
              <description>
                Represents the outcome or status of the SSH access attempt or session.
                The parameter indicates whether the attempt was successful or encountered an error.
              </description>
              <syntax>
                <string>
                  <enumeration value="SuccessfulLogin">
                    <description>The user successfully authenticated and logged in.</description>
                  </enumeration>
                  <enumeration value="FailedLogin">
                    <description>The authentication attempt failed due to incorrect credentials or other verification errors.</description>
                  </enumeration>
                  <enumeration value="Error" optional="true">
                    <description>An unexpected error occurred during the login process, preventing login.</description>
                  </enumeration>
                </string>
              </syntax>
            </parameter>
          </object>

          <object name="Device.SSH.Server.{i}.Stats." access="readOnly"
            minEntries="1" maxEntries="1" version="2.19">
            <description>
              This table provides statistical data on SSH login attempts for the server instance.
            </description>

            <parameter name="NumberOfFailedAttempts" access="readOnly">
              <description>
                The total number of failed SSH login attempts since the device's last upgrade or initial boot.
              </description>
              <syntax>
                <unsignedInt/>
              </syntax>
            </parameter>

            <parameter name="NumberOfFailedAttemptsSinceActivation" access="readOnly">
              <description>
                The number of failed SSH login attempts since the SSH server instance was last activated.
              </description>
              <syntax>
                <unsignedInt/>
              </syntax>
            </parameter>

            <parameter name="NumberOfSuccessfulAttempts" access="readOnly">
              <description>
                The total number of successful SSH login attempts since the device's last upgrade or initial boot.
              </description>
              <syntax>
                <unsignedInt/>
              </syntax>
            </parameter>

            <parameter name="NumberOfSuccessfulAttemptsSinceActivation" access="readOnly">
              <description>
                The number of successful SSH login attempts since the SSH server instance was last activated.
              </description>
              <syntax>
                <unsignedInt/>
              </syntax>
            </parameter>
          </object>
        </component>

        <model name="SSH:2.20">
          <component ref="Root"/>
          <component ref="SSH"/>
        </model>
      </dm:document>
