Getting Started

Overview

VyOS is a Linux-based network operating system for routers and firewalls. With the Britive Access Broker, users get just-in-time access without any standing accounts on the device: at checkout the broker SSHes to the router using a service account, creates a temporary login user with a randomly generated 16-character password, and returns the credentials. At checkin the broker deletes that user from the router configuration and saves.

What you’ll accomplish:

Register a VyOS router as a broker resource
Create checkout/checkin permissions that add and remove login users
Verify a JIT user is created at checkout and gone at checkin

Before You Begin

The Access Broker is deployed and connected
A VyOS router reachable from the broker host over SSH
A VyOS service account with authority to run configure, set/delete system login user, commit, and save
expect available on the broker host (the script installs it on Debian-based systems if missing)

Do not hardcode the service account password in the script. Pass VYOS_HOST, SERVICE_ACCOUNT, and the service account password as broker environment variables and source them at runtime.

How It Works

The broker runs expect to drive an SSH session: it logs in as the service account, enters configuration mode, applies the change, then commits and saves. The requesting user’s email is reduced to an alphanumeric username (everything before @, non-alphanumeric stripped).

checkout → ssh service_account@VYOS_HOST → configure
         → set system login user <jit_user> authentication plaintext-password <random>
         → commit → save → return credentials

checkin  → ssh service_account@VYOS_HOST → configure
         → delete system login user <jit_user> → commit → save

Checkout Routine

Full script: VyOS Router and Firewall/vyos_router_add_jit_user_checkout.sh

Environment variables:

Variable	Notes
`username`	Injected — requesting user’s email; the login name is derived by stripping the domain and non-alphanumeric characters
`VYOS_HOST`	Router IP or hostname
`SERVICE_ACCOUNT`	Service account used to log in and apply config

Derive the username and generate a password:

VyOS Router and Firewall/vyos_router_add_jit_user_checkout.sh

JIT_USERNAME=${username}                         # full email from Britive checkout
JIT_USERNAME="${JIT_USERNAME%%@*}"               # everything before '@'
JIT_USERNAME="${JIT_USERNAME//[^a-zA-Z0-9]/}"    # strip non-alphanumerics

# 16-character random alphanumeric password
JIT_PASSWORD=$(head -c 16 /dev/urandom | base64 | tr -dc 'a-zA-Z0-9')

Create the user over SSH via expect:

VyOS Router and Firewall/vyos_router_add_jit_user_checkout.sh

expect <<EOF
log_user 0
spawn -noecho ssh $SERVICE_ACCOUNT@$VYOS_HOST
expect "password:"
send "$SERVICE_ACCOUNT_PASSWORD\r"
expect "$ ";  send "configure\r"
expect "#";   send "set system login user $JIT_USERNAME authentication plaintext-password $JIT_PASSWORD\r"
expect "#";   send "commit\r"
expect "#";   send "save\r"
expect "#";   send "exit\r"
expect "$ ";  send "exit\r"
EOF

The script returns the generated username and password so the user can ssh <jit_user>@<VYOS_HOST>.

Checkin Routine

Full script: VyOS Router and Firewall/vyos_router_delete_jit_user_checkin.sh

Delete the user and save:

VyOS Router and Firewall/vyos_router_delete_jit_user_checkin.sh

JIT_USERNAME="${username%%@*}"
JIT_USERNAME="${JIT_USERNAME//[^a-zA-Z0-9]/}"

expect <<EOF
log_user 0
spawn -noecho ssh $SERVICE_ACCOUNT@$VYOS_HOST
expect "password:"; send "$SERVICE_ACCOUNT_PASSWORD\r"
expect "$ ";  send "configure\r"
expect "#";   send "delete system login user $JIT_USERNAME\r"
expect "#";   send "commit\r"
expect "#";   send "save\r"
expect "#";   send "exit\r"
expect "$ ";  send "exit\r"
EOF

No standing user or lingering permission remains on the router after checkin.

Configure in Britive

Create a resource type

Go to Resource Manager → Resource Types → New Resource Type. Name it VyOS-Router and add a hostname parameter.

Create a permission

Go to Resource Manager → Resource Type Permissions → New Permission. Set Language to Shell.

Paste the checkout and checkin routines into the Checkout and Checkin fields. Declare variables:

Variable	System defined	Notes
`username`	Yes	Injected automatically
`VYOS_HOST`	No	Router IP or hostname
`SERVICE_ACCOUNT`	No	Service account login

Attach a response template that surfaces the returned username and password.

Create a profile

Go to Resource Manager → Profiles → New Profile. Set an expiration (e.g. 1h). Under Associations, select the resource label(s) covering your VyOS devices. Under Permissions, add the permission above.

Add a policy

Under Policies, assign members (users or tags) and configure approval or time-of-access conditions as needed.

Reference the resource type and scripts in broker-config.yml:

broker-config.yml

config:
bootstrap:
  tenant_subdomain: mycompany
  authentication_token: "<broker-pool-token>"
resource_types:
VyOS-Router-Resource-Type:
  Rotate-Password-Permission:
    max_supported_version: local
    checkout_script: /opt/britive/scripts/vyos_router_add_jit_user_checkout.sh
    checkin_script:  /opt/britive/scripts/vyos_router_delete_jit_user_checkin.sh

Verify

Check out the profile

Navigate to My Access → find the profile → Check Out. The username and password appear in the response.

Log in to the router

ssh <jit_user>@<VYOS_HOST>
# Authenticate with the returned password

Check in

Return to My Access → Check In.

Confirm the user is gone

ssh <service_account>@<VYOS_HOST> "show configuration commands | match '<jit_user>'"
# Expected: no output — the user no longer exists in the config

Troubleshoot

Symptom	Cause	Fix
Checkout hangs	`expect` prompt mismatch	Confirm the VyOS shell prompts match `$` and `#`; adjust the `expect` patterns for custom prompts
`expect: command not found`	`expect` not installed on broker	Install it (`sudo apt install -y expect`); the script attempts this on Debian-based hosts
Authentication fails	Wrong service account password	Verify the injected `SERVICE_ACCOUNT_PASSWORD`; confirm the account can SSH to the router
User not deleted at checkin	Checkin routine error or commit failed	Check broker logs; confirm the service account can run `delete`, `commit`, and `save`
Login user can’t connect	`commit`/`save` not applied	Ensure the checkout session reached `commit` then `save` before exiting

Next Steps

Deploy the Access Broker if you haven’t already
Source: britive/access-broker-examples — VyOS Router and Firewall

Last updated on July 8, 2026