The console banner#

/etc/issue is what agetty prints above the login prompt, and on a Wheelhouse box it is rewritten at boot and every 20 seconds afterwards with the URL of the web UI on every address the router has. On a brand new router it also carries the first-boot password.

  Wheelhouse 0.5.1 -- edge  [live image, not installed]
  ==========================================================================
  Web UI:    https://192.0.2.1:8443  (eth1)
             https://[2001:db8::1]:8443  (eth1)
  Sign in:   admin / 3f9c1a72b8e4
             first-boot password; you will be asked to change it
  Console:   vyos / vyos on the live image; the installer sets yours
  Install:   on the first console; elsewhere run: sudo wheelhouse-install
  --------------------------------------------------------------------------
  Built on VyOS 1.5-rolling-202608220006
  Licences and corresponding source: /usr/share/doc/wheelhouse
  ==========================================================================

That is a live boot. On an installed router the same script prints:

  Wheelhouse 0.5.1 -- edge
  ==========================================================================
  Web UI:    https://192.0.2.1:8443  (eth1)
             https://[2001:db8::1]:8443  (eth1)
  Sign in:   with your Wheelhouse admin account
  Console:   wheelhouse, with the password chosen at install
             vyos is kept for recovery
  --------------------------------------------------------------------------
  Built on VyOS 1.5-rolling-202608220006
  Licences and corresponding source: /usr/share/doc/wheelhouse
  ==========================================================================

Every line fits an 80-column console.

Line by line#

Live or installed#

boot=live is on an installed system's kernel command line too, so it cannot be the test. The live image is the one with a mounted medium, which is what the base platform's own check looks at:

[ -e /usr/lib/live/mount/medium/live/filesystem.squashfs ] ||
  python3 -c 'from vyos.system import image; raise SystemExit(0 if image.is_live_boot() else 1)'

The cache#

Three of the values cannot change within a boot except through a package upgrade: the agent version, the base version, and the live-or-installed answer. Resolving them costs a dpkg-query and a Python interpreter, so they are cached in /run/wheelhouse/banner-facts, keyed on the mtime of /var/lib/dpkg/status so an in-place upgrade invalidates the cache. /run is a tmpfs, so it dies with the boot.

When it is redrawn#

wheelhouse-console.service writes it at boot, ordered before the getty units by name. wheelhouse-console.timer runs the same script every 20 seconds (OnBootSec=0, OnUnitActiveSec=20s, AccuracySec=5s).

The script writes the file only when the text has changed, and only then considers restarting anything.

When the getty restarts#

agetty reads /etc/issue once, when it opens the terminal, so a banner written afterwards is invisible until somebody presses enter. When the text changes, the script restarts the login prompt on every console where all four of these hold:

• the unit is one of getty@*.service or serial-getty@*.service, and active;
• its MainPID really is an agetty (checked through /proc/<pid>/comm), so a console running something else is left alone;
• not tty1 while /run/wheelhouse-install.lock exists — on a live boot tty1's getty unit is the installer, and restarting it would throw the operator back to the welcome screen;
• nobody is logged in on that terminal, per who.

The permission rule#

mode=644
[ -n "$initpw" ] && mode=600

/etc/issue is world-readable by convention, but while it carries the first-boot password it is a credential. agetty reads it as root, so 0600 costs nothing and keeps a local account from reading the password off the file. It returns to 0644 as soon as the agent removes initial-password.

Turning it off#

The banner is a service and a timer, so:

sudo systemctl disable --now wheelhouse-console.timer
sudo systemctl disable wheelhouse-console.service

/etc/issue keeps whatever text was last written. VyOS rewrites it from system login banner on the next boot configuration load.

See also#

• systemd units — the service, the timer and their ordering.
• What first boot does — the other banner, the one sshd serves.
• Files and directories — initial-password, /etc/issue, banner-facts.
• Ports and listeners — where 8443 comes from.
• First sign-in
• Console access