Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

TACACSPLUS_PASSKEY_ENCRYPTION support Part - II #81

Open
wants to merge 18 commits into
base: master
Choose a base branch
from
Open

TACACSPLUS_PASSKEY_ENCRYPTION support Part - II #81

Changes from all commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
8b909b8
TACACSPLUS_PASSKEY_ENCRYPTION support
nmoray Oct 25, 2023
48e7d1d
code cleanup
nmoray Oct 25, 2023
c877edb
Added syslogs
nmoray Oct 25, 2023
b37ddcd
Removed debug prints
nmoray Oct 25, 2023
945f4f2
Fixed AUT issues
nmoray Oct 25, 2023
5b61c0c
Fixed build issues
nmoray Oct 26, 2023
7cb53e6
Fixed build issues
nmoray Oct 26, 2023
43641de
fixed build issues
nmoray Oct 26, 2023
66b57b5
Added a check for passkey before appending into server configs
nmoray Oct 26, 2023
c6c8e0a
Fixed build issues
nmoray Oct 26, 2023
977a268
TACACSPLUS_PASSKEY_ENCRYPTION support
nmoray Oct 25, 2023
a7d01d6
Merge branch 'tacacs_pass_encrypt' of https://github.com/nmoray/sonic…
nmoray Oct 26, 2023
0a1b098
Fixed AUT issue
nmoray Oct 27, 2023
7b14786
Fixed build issues
nmoray Oct 27, 2023
911e2c0
Addressed comments
nmoray Oct 30, 2023
bb5e5ee
Incorporated security cipher class into the existing implemenatation
nmoray Nov 24, 2023
d745364
Added a logic to remove the cipher pass file file encryption is disabled
nmoray Feb 1, 2024
1d85eb6
Updated class name
nmoray Apr 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion scripts/hostcfgd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ from sonic_py_common.general import check_output_pipe
from swsscommon.swsscommon import ConfigDBConnector, DBConnector, Table
from swsscommon import swsscommon
from sonic_installer import bootloader
from sonic_py_common.security_cipher import master_key_mgr

# FILE
PAM_AUTH_CONF = "/etc/pam.d/common-auth-sonic"
Expand Down Expand Up @@ -75,7 +76,6 @@ DEFAULT_FIPS_RESTART_SERVICES = ['ssh', 'telemetry.service', 'restapi']
CFG_DB = "CONFIG_DB"
STATE_DB = "STATE_DB"


def signal_handler(sig, frame):
if sig == signal.SIGHUP:
syslog.syslog(syslog.LOG_INFO, "HostCfgd: signal 'SIGHUP' is caught and ignoring..")
Expand Down Expand Up @@ -500,6 +500,17 @@ class AaaCfg(object):
server = tacplus_global.copy()
server['ip'] = addr
server.update(self.tacplus_servers[addr])
if 'key_encrypt' in server:
secure_cipher = master_key_mgr()
if server['key_encrypt'] == 'True':
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this value depends on how 'key_encrypt' was set. It can also be 'true' instead of 'True' (it's actually more correct to use 'true'). there's an is_true() function you can use if you don't want to worry about which format you might get.

output, errs = secure_cipher.decrypt_passkey("TACPLUS", server['passkey'])
if not errs:
server['passkey'] = output
else:
syslog.syslog(syslog.LOG_ERR, "{}: decrypt_passkey failed.".format(addr))
else:
# Delete the cipher_pass file if exist
secure_cipher.del_cipher_pass()
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this will delete the whole file, probably not what we want. it should be enough just to remove the TACACS entry, or set the passkey to ""

servers_conf.append(server)
servers_conf = sorted(servers_conf, key=lambda t: int(t['priority']), reverse=True)

Expand Down
Loading