From 7764bf58e4a1a567ec11d26a9476c734e5f37568 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vin=C3=ADcius=20Fontoura?= Date: Tue, 3 Dec 2024 09:40:09 -0300 Subject: [PATCH 1/9] [fix] markdown lint rules --- README.md | 79 +++++++++++++++++++++++++++---------------------------- 1 file changed, 39 insertions(+), 40 deletions(-) diff --git a/README.md b/README.md index 08ddca5..82fe84f 100644 --- a/README.md +++ b/README.md @@ -5,7 +5,7 @@ is minimally maintained and has a lot of issues. This plugin is a complete rewri and flexible than the original plugin. It is also regularly tested with the latest NetBox releases to ensure compatibility and stability. -# Features +## Features * Store secrets in the database encrypted with a public key (RSA) * More generic and flexible than the original plugin (e.g. secrets can be assigned to any object in NetBox) @@ -13,7 +13,7 @@ and stability. * Updated user interface to make it easier to use and more intuitive to navigate * Regularly tested with the latest NetBox releases to ensure compatibility and stability -# Compatibility +## Compatibility | NetBox Version | Plugin Version | |----------------|----------------| @@ -25,7 +25,7 @@ and stability. | 4.0.x | 2.0.x | | 4.1.x | 2.1.x | -# Installation +## Installation * Install NetBox as per NetBox documentation * Add to local_requirements.txt: @@ -36,55 +36,54 @@ and stability. * Run migration: `./venv/bin/python netbox/manage.py migrate` * Run collectstatic: `./venv/bin/python netbox/manage.py collectstatic --no-input` -You can view releases at: https://github.com/Onemind-Services-LLC/netbox-secrets/releases +You can view releases at: [releases](https://github.com/Onemind-Services-LLC/netbox-secrets/releases) -# Configuration +## Configuration The following options are available in the configuration file: -- `apps` - - __Type__: `List` - - __Description__: List of apps to enable - - __Default__: `['dcim.device', 'virtualization.virtualmachine']` -- `display_default` - - __Type__: `String` - - __Description__: Where to display the secret on the detail page of the defined apps - - __Default__: `left_page` - - __Options__: `left_page`, `right_page`, `full_width_page`, `tab_view` -- `display_setting` - - __Type__: `Dict` - - __Description__: Set display setting for concrete model - - __Default__: `{}` - - __Options__: `{'app.model': 'display_default'}` - - __Example__: `{'dcim.device': 'full_width_page', 'virtualization.virtualmachine': 'right_page'}` -- `enable_contacts` - - __Type__: `Boolean` - - __Description__: Enable contacts for secret - - __Default__: `False` -- `public_key_size` - - __Type__: `Integer` - - __Description__: Size of the public key - - __Default__: `2048` - - __Options__: `2048`, `4096`, `8192` -- `top_level_menu` - - __Type__: `Boolean` - - __Description__: Enable top level menu - - __Default__: `False` +* `apps` + * __Type__: `List` + * __Description__: List of apps to enable + * __Default__: `['dcim.device', 'virtualization.virtualmachine']` +* `display_default` + * __Type__: `String` + * __Description__: Where to display the secret on the detail page of the defined apps + * __Default__: `left_page` + * __Options__: `left_page`, `right_page`, `full_width_page`, `tab_view` +* `display_setting` + * __Type__: `Dict` + * __Description__: Set display setting for concrete model + * __Default__: `{}` + * __Options__: `{'app.model': 'display_default'}` + * __Example__: `{'dcim.device': 'full_width_page', 'virtualization.virtualmachine': 'right_page'}` +* `enable_contacts` + * __Type__: `Boolean` + * __Description__: Enable contacts for secret + * __Default__: `False` +* `public_key_size` + * __Type__: `Integer` + * __Description__: Size of the public key + * __Default__: `2048` + * __Options__: `2048`, `4096`, `8192` +* `top_level_menu` + * __Type__: `Boolean` + * __Description__: Enable top level menu + * __Default__: `False` ## Extra Configuration The following options are inherited from NetBox to configure the cookies: -- `SESSION_COOKIE_SECURE` - - __Type__: `Boolean` - - __Description__: [Session Cookie Secure](https://docs.netbox.dev/en/stable/configuration/security/#session_cookie_secure) -- `LOGIN_TIMEOUT` - - __Type__: `Integer` - - __Description__: [Login Timeout](https://docs.netbox.dev/en/stable/configuration/security/#login_timeout) +* `SESSION_COOKIE_SECURE` + * __Type__: `Boolean` + * __Description__: [Session Cookie Secure](https://docs.netbox.dev/en/stable/configuration/security/#session_cookie_secure) +* `LOGIN_TIMEOUT` + * __Type__: `Integer` + * __Description__: [Login Timeout](https://docs.netbox.dev/en/stable/configuration/security/#login_timeout) __Note: These options should be set in the NetBox configuration file.__ - ## Screenshots ### User key (Without Session) From 8d6dd9ab031b7cb1d74de21beb779dbffd8360eb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vin=C3=ADcius=20Fontoura?= Date: Tue, 3 Dec 2024 09:53:11 -0300 Subject: [PATCH 2/9] [created] creating the first user-key --- assets/first-user-key.png | Bin 0 -> 22096 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 assets/first-user-key.png diff --git a/assets/first-user-key.png b/assets/first-user-key.png new file mode 100644 index 0000000000000000000000000000000000000000..3e599264f9058c53cf2624ee975d8dcce88e2984 GIT binary patch literal 22096 zcmeFZXH=BmwCDgeS1F4TC?VUa3SSeC+vOB-p_uX{TlXGNe=Hm#eE0_g7^BBv?>I0 zyB7ROz`6}Sk;o~J2S2bKU+K6&Aozc8{@hAn!KZ{k9z$MBzf|{3-I_M{RU2#mv+t6U zJ@e#|?)dm`?B?fujecS)RmcE5oi@ji+FHB`$0SZB)hXjD(opXdzQOUsC#=fo3N=f) z;MvpWh?SMj*Q(!)9F$aB5N77LAdp!0&@CD;ar<2+OfZ!kC-}QyIQWNl67oIlghWaf9|FyyEcYB(Qj5*y@-IaPs#58hDkxaBaHpAh91$yEX zZ`RcoMOA7$&r0`~k(PI+)ZVM{_W6+bTALyzHSUaVzL^tUP~eY9NQ(SlY zFQzv%+LXU~on+wj`RPL-hLY=#0$WV5H-?&x~3#z7}t!JI&V=>XGiD6}&-GRhDfV%(akJb}|)O;1mK-pP^PH`zt#^|()F z*>4kEYjaub8d0wFB%iHNK2xg~#M>CLzurz_8M7U)G)*FGYHZ9jMUv=^vY~ytzFqtI zRM*rD=bg_q&cQ16o(5?noI94B5aw%!cOZ|86^hA53um`>Rz}Nw+J54QPE9jLQ5UJ^ zg+zUGylRE1G-DD!r*b?v(jg^H;#Wx6JKo3Nkbx^GVLjktAw@wXZOld&uADe%6DM@wtWi5|0HWW#K; z?&^IWSRsv=x9{kbOy#p#=un~gp@SxDn#b!R^>nsircAGmzD=1NH%tSA1)I(g3d_wX z?z_ea9U=$kn1i6rwaDioiI{2c#|)p-@mlnEKjWwkjr&V|Xw%sb{0^aDbyK z4OK%S5Kph4TDX#*dXVm;Md$u+Gt%W^GRoQZ5BEtVyVE!u-3KNnCi=!0#pvccM>dx` z8;Hos-7dDov32dvOLvpstn>?efSrBbE|W?jp`I)!lzeJgA>~hL!Iv^b{^u$*Cf$F3 zZoYP;AeUN={C7sNhqUw;r5sYpsXA)!LwCzgH_6?pTBpMkiwqt-LD!?ddEAm%MzpkO zNq=y%A4%q_Ggs(tFRz!N=jK1Wtj9S&*TgIIoL^YZ&0Ra%r3JU-;b#*<$;huS+}4}E zDpHJ=8AN^xCy_itxoLY!2N6pCQf+Cq3L<3eOGQ;#HLtCWS5U$&D{Ac1CcnMOmXeFk znVQdr2}|PBjBFl{*-w>=_8@!jRaMutwzi(15x=Q%9?%LOZ}0?XjzY0+z)Zfn`S)J? z{pGHjnwmA&i_g!(HHs;!yf%%TC=>_X7?jf7z@~x^%r8ziNAmqn&w_&5b8{*A9s0h( z+ud2Z-DMjA^1L>|Hi<1d<+Hra%b}=3%`{*8s+fKZF9KN`dy1Cir}YE6Sc61 zu(042-&s<2)CK`1+3;3bOu3LjsoN1|pk@IjuYGuN%xR3cD~aURIJthk_428Wx(^D* zFNa4dVEZn%#Uw07S-@q-w_q3H?(S~#5QJEF@{2n;cEaw|f+t5B*ij4(yBvWAscH9) zchwN~u=9vS8Ua^zET`)Q^FX@&*V<=+p)o&xn1YkQo6=*^o7UHU-Ipqiu-Q)zlFv&i<_Vu9&F~|3-fJ(cj!>Jvylm-emW}3675HwnOY16RfNrFJlb04w zD48mT>bp=xQt%g|8hu8Ru1maoE_!+pD6U-P7~qomtc-@#kwG82EcEj{q|!)UDj^bY%^FP6hAocO<{*(!|Ga$Vj z%kEf|OJLS$@*kP{s;0|}*2KzG&5I7&vL36E8KiH}JQ|^=s}&Iu86@v0+NPAnr(Ie! z==UG_f}Ir)LoA%0XZQ|FW2rp*{n@WMc8)q?rKj*MNPpBwNN3%ld#PQ)9nJgLGxmsF zCi${Hah-kCDFu(s$7DiPN&8rtI4la|+oc?Ld5)xOKtomX(H5#PRsSP*Kt#U9eqX5eq@ zDt#5m)~IDCiMS+iB#X*+_y&ISG)Dfxks{}?j^gJw-;566{%{`qw+P7-Ua z^Re!HK!AN3GKobi+o!K#ooaHV#T*#B$e@<8z^vN@KP$@JKBOkC9Ndh_BiMT8Ey=XxYyBHM?%3^TV#g*N*dhH&+oH=If|4B zbtHI}Z@>B+JOvEI!^9Z!SDA@KV`zoWSF{spX}V z9Esm?g0uNd$9UB5Nj{JsEJmm9a+Z{geXIwMsIO252?oM&tpe&`!r=So ze#b32Y8KrcuP|>x44JFHlYK7L4JK?#wtQoe_M^Dr;6%@%*Qo00dXtPoA|-Cv-TO<* z)z^j9I2e~#h_kJU-sZLzD-ft}-@Y$8q^Ya}lQs3`r_0M$q}ZBzlzK$`>W%HzIJTOJ z>CmOil7Vmq$JL3RpFd6Ri1ja&QMGqkU|`_(ipTo+&eD1raCrCJH~ zu7bWtRag3w`SOXZ*LwqtjK=e?Nke9;k=3Y}fdS6vW6G~yk%@bG!+W=J9vyU@y-Q6? ztH&XUjEw9(W01s>lWQZHg=V>{W{CJP1g6xfJp>2_fAm<-&Fp@P#s46f3Kq$CS?FZBYClSS`U zeBAMfb;UM=K;DRKmety)0VgMN>de)$sZ^5|L!1p{mq`f)ZpatYSKdZ2L%36Gp;u*b z;OP$fqN^|G4OzYMP@=HMuKAueIC=8#Bk0!S`@02kG+{ckl^TbYuoPsXrCUuaEw6%G zMP7WXI;&A{<dD=tMsi=LMoXRwYoyLiM7qtQb!pcga2*&zE9A>VkF>r% zUHRG9H|8<(@tMEBSTpA7ZvU^)0ZVzIkVHFSBuDF&Lolmhjmg28N<<s}s=&wA@Asf7jdA<~DcNWVVOwF3BI zyy3+f-YKm}xu2;2VEMzA2wr<_hxPCTNvwLqj02AaN`CvhXQT&*#}yhaO)Xu(mc>k+ zr7bQMLI%40Pq~<_FABZHPqr?)0y3>&rZ~g}gxLGoaVjb&%R==tL)_=Job`2euHILO zq{5RF$JHHCT8G`@hBKbP7RT+2D3G#u&TO;>gK6uunr-=Ve2o_l5^N%piX7dXbZR{9 zb588u_v*wh$=e965-cn(1{3aMW1l?hyK2wYXM@R+Kw=}zD#=vEuv`ANW~W-jI#)0% zH+^Os*u*0jd`3e_xw*2E*n8h&cNziWS=$LrF8b@^pihzE;gR9_YMU5Y1D>1imO_;F zGc{Spfi>bMYl)-x^Dx5+7dA$0s3$9#Re$aULd(AEPk8v&;TYC`yKorf=>*eE}dZa*?-O z|F-bJ7*>!QyTGLZXA9#J2b)e`Umx5b@7?JQfWzarm?`TU-=!c0-d}zJ-><2zv7f1w zDj2z|ncrX90zV|ZX7}6ulk60q#PRjCkY2=T&2?QP3 ztNA7ap^91$bYri9&mj3=a70qlRf+Xpz;_Zmp^0AF@wV8}4-m*JId-NH0B(zn>h-aV zc_?iKQ|jvtb;Gt_pj^v9X{1!CT(D>6U~l-Lw2Z6k3hr)DQQ&R1Z_tkySE^%faN z+Th&j|Mt{5Wv5QJ3L=T9aOnRNy{+qJIac%T!)@iJrfcnL_jB5UEtcGo=t?JD*2Lex z_j>f;jP>py!=Ds`@@P7QmJx|wbBagUpG+hf`Re|3lu&o=-kGZhQ9s__tm((IE*td% ziedQJ_e}cuXu33vTaZ{1Km#nBMW{0;=zR!Cmg6rozrjT|%LGiBQT}FpDcoi8Q%7Ea z33y!l_J805{&x}Be}`QD9hTugNBvI={C~*;UF$9V)lx_RoTPcu&Jfx*Xt}yqSnZ>gIY~a&Jyx!19tY_vK(a+%}o&PX~n%% zGkvRP>T5{xv68u=DnfeIHC1oO4v`f${0vH8<81f%Dp3}_buBj6`l`iBu(^7aT^F+a zLJZ{8=4=@G4R_SB^wH$su=DHcDKjqesMZrZz25ZN7gu<+fQ|yphP2c|@k_r3yMbQo zitLIN0K72qsH@$Y^8q#%MD?BHM)q3MA^{-X7|qjx$G68Fs#okD1u7Mj zO6u3SE;qF(aOWtEmz(S5!?mz7nL7JlBADV@3@s`DU`CMwKS!0SL74uUUC$MU{XeAXy|N zGFK_%2Q0hW!^3~@*sDX=55(=N-?;#5554bob8}O)DJV*tO!7y;#KZ}Ptt$ql3ia!I z8yn{%`otbcy8fR~xE(;@SI;41ZR@HO;rXt3ygCLUGdy&a+lmr|SlX|)()#D^*e z3`A2?Gq>}nzkmOJEn9`#O#e`AIXK=J{>EpjBwKkK@>rvKP9u!@1HiW={{`Ppa`b+M zuf_brX+W)XEkg@G?=W*QPYw-nr#-5x6RCCEAnGn7>7=sS>xSu zI0BEnAKJes6&fSYA30Yn0|3>%KZ|~x~()e)u98_M#vsGUYn33^C8lQsB z0H?-;a!xbcU0;uLRpj7MM#f$nysJmgWo{RMV&UA=2MTID^5-Gr<5j=+_5dPfNMShF zDC<*76H7S=4(rk?Vl%910>$t8LUr0C{HvhFhpYUf-Hfv{PdaH|$&Y>=F5)EQ&~^yK zOBuLh*+t`xt?e7z12}26{&q+FZ!?7>?`D?_!3-|DlZ-CXn(FFbWlEcgv$N2>IRJK_ z7t3$HJ_UHQ!n#4+qw!(<`ugq>;M{NtVm?L6`z1=fc@vqU_wA4*zEl?m-JY7xZ-Ju- zsD?K)8v5T>b_>`0uN{ndz|@Kygn54qZH7jXar<2SqzBBNmsh)b+VeT&*OkXJDWNgm|`Z(AxLYt!7%kc(Kir*>V?Z4rZ+>`?;flo0MH#Kcj2>7gfQ z&dmM)0~f|>=_rPHawwm&P9&KoZrufZ-wVxn!@~`hVgZ3_M(wh99;v``j|sTed1Z|J zMh03I8=K{HN~M4n7f{!lJ5+alu_?LiyE)l1X2_QM4D}NbpzUgrLOqlYUrL#xGx>`( z@^nR+h1eC`6@Z8r>p|xBjmun~@=c;Je=*|p8a3uHGw`>~q9gq|5c&?VvXs;+w}dHR z^EF*tIn*vpGuyG5ilD^~AdsQe+dy}#oD1M5%+-r{ccp74P9KtFny`l3? zX;`?{%e(^+oqwR6wx5bMVe+KN^JWiB` zbtGGYYDWh*&tJZL#H1uSG7SHHyiD-}`S<5J+j5hIXMQfITJJTw+HwSN$@?EhfeW8e#=> z*6`$+xT_WPg=ay0yxM#G_ej|G?9TQkLnMuEdmsO@b>PM6S6;U%?(J&lmV<3w=x*$X zvA1IOlWXtxMuDD*Lq|nyKGoicajSpBJMekKIG26lK-Xnil#m)8_FiaVh zj4IqsfvN(f92B3Z2>&rv_sILav%+H10?<~I6&Hq1o|S40X~O0HaPN_QwfE^)t4-W? zSdc$m4D~tM5iJjgb3#LFeM*;q$&+M=+FhnoZzgek)5y~OPPmXmW8m(fSD=~~L};VQ zI#oHZETcj!Gtsc$2lS?RJOBN`1U95cuTi<}bSv!FtT+81M8Ag-)aixi=IJaCvfj>a zo-G{uqBxDbi-SVPW29mK?R z56t2;`ZcL{Rjo3Gu>LPqJWAgAizvOU5IiPTfjK}!va_>0Br?x$E>h1KF=ZsJZWh;H z=niPri-;!1UG z8oNy`EX}ftdyXEo;?}P^wOD5S%hb^gq6D;}Vm3QZke_!ER->io`~{=--$eX+QM($u z6EIWPH{ItrN%7@s3-pS9=Qw2KH>Jc@!&qft| z#(Qyax#0EbRIP;;;Bf)##fEO6UCLs>!>1A{z3k(a#1c2kNbEt-@LRP4DcZ+C>01{}=wk8aw}Gp>`^n*P znDVPC=VR~c(p_m;*)%bf@<&a*hAm-+c)_FI=}+ysW~iXu3+KU<4qpQ8O-TA!m_ge15y>2hMxBhQ$c?#cZXdnc3D)QBeT9`yS_i zn7NBXCF0y|$pc8XLYp?evK2PN>i1G%3&kAi!feZ$ad87GDg)w|#81INyH_wmL7q^j z`@fKSv;L8K>G+gfjwhq6KP1%E;{dgU;cDPEBsR2TR-cfBhSTrlHmdj_G=?T7YN*`m z+%E57i}?BP{Zg5-u7<-(!iA;0GJs_`47V!Oa{AK5TzdP)avTHD9m5QqQ`J7`@i4X3 zUZd`IqP=v#d(2v_TBXvQNQH+C@j6%!-nJJ@R&!A!E6aIJQ^SCS&AjWkcFSs2+&|vG-Vg1S{6sArSfB;F^pCQ3Kpd~+ z8e@dw;g)K%N`AV!hp$zjTW$Mw5QV?@`3_`mIUy5HZ;ve5Y%j@ST;lz9)_}lucXFp0 zMkoWNbcI9Ld#+yvlqC^Kcp-m*o&FkZ z>GSn6bm43{%&EBsTx!2{+Jdpd*{RD~j=+l}Kn_!gU95MpqwuLt4vy4=ULE^l185hf ze(nD3vnsK9TXsScyU`{!4^wU1ZHPo=T%W1u*911Tn%B+VK$U@BQ3FL7fLY;vk7t8J zRWH**j;-ycN`ZiP^^Y!GN>mI)UWj1t|9#KV|1&0tO3fgjNpg8@YiT3T+1aZR12kCa zw4~-L4_kFJ1de>0F!-g48~%ifI?dqVd}HAWo=Qy6$mfYbpeU0nJ2|=^I`^y=#NhFp z3sIHaZ`w?M!y!T5OgE_ifs$u~ntb=F z&U^bJa^kShsEVoHdSUzl?2RtUk)-mY5o6*DEw&;hj&rTWZ5F~f0dJntpI-LO%D6uxibKDzMqdJcnz zZ_a2tUHEv}uEbheEjeu%9PSZX$p(bB=^820vI*6qE#XBuf(&8ketSv$ftOdM1Jb!O zh;v)W4X&MjZ5M4)jLwOWSHozd4AsHVvZ@$oYB_nQut)VscJaMId1e&uh>wR`<3r1%esJ#Izc`GnPk2SF=7-Nfa zv_KCvyv_|`OrBAW<~JX>uAMN#|8NBaIET;~tH~<=&Vu*d=};hC#mgSY+h6R>X9134 zB=5MvFDxR$VG{s0F>s8tN9uJTz2_=i6-g-?;x*1%=IQo8SRcsE6t{0<@H%DfmdwUJBQs8gBbJq@2HOsVf z854zu`JOkZs0cSKPe!}(SS?JRFzn3B)RlpwN&U>9x{0_QlQZ>N5++F zlXLQG);~+R9|BWiG4NX6a0?HV0z~i)dpP`Gh4jgN2;>^4I*&|bY8rZ(xjCQJW{UO* zm*9G)kmz}|whzGIPaLV;sqLvNIn?vhp9_mbt;*>$Ff|`wg-8O~?KN!x4y(om=>ASd z=`m{+z3}U-5~{EPxS3I}Og-$OjL~!Fxw%Y`027#XegNZem7<>nWBhoMrCOgKTkK$K zdoYG|vNeGoP5E_+Bgz&gR53GK%klTR)(0d)0xA((9tr|#K~04Hr0!B8t6;$mS4 zWXn=T_Bi=BZ&C#<{8L8Rm^GM;;P$X}?iI87cMu3VP5&+KhXj`G>1y-cUN)%1?A~aK z!&ATLyocJ)pL*6_&7yWk2qiteyn!b&)(PqE;nRvb9jyB2A#CG5Yl#&biq?=twGLVI zVbj^q;@b_>3{4B4`mYb!pb{&946RH-3*1xVyR7T!xpajh0MEdT;O-Z~9`5cJOIg{= zU0)`ScWv&w11emRk{`EF-^rmp(@aYgAE(xH-FaJg7l&@x`q*bz6M40}vSYt9QgAnf zN`N&8OVDvG(8ESRSopPrDNubs&%mE6yuwo1IvxwWIC&Uu^5Q8&E%QidD}!g>wXnwy z=xFh7Ze`2#*nKT`8`6%=C49(vv%gIp7m`B#vIe_?6+1nCINN}gTa=i6;)b;vV|1Q& zW~yBW@HCYCMY-g8=?VW`EIPo1dL2*V-7uj^ve9XegB-z57KUP0yT4858!#dr%2zq` zDY)%F`^7Upcp&*nK(P*hPQUp+KX1R`^0@6y;1VJK1@(M>vxOycD7(>c)yruXt>PRv z(*n&rU&mb~x*+*wLK2b(JdU|nUk?DnUSw3x;IVt(a(@|FX)k7T@mF)Z<}c$@EV_-6 zyb5!a64DxAk9=U(LHPUeyb)_;{nFYR8DO=M$@}~cGnGc>;zf-DlOX8h=^rr)HDZ1UO9 zl=k?m6exf^4)RLfT?OAO-%z}r*-RILtaY>zoBVNRiQa!9YOfon8lKY6zRL3tHM^w5 zhQyM8Wed@KJu_e-yb3~-CaNs1#rm~P#egYeb(H{UvN#r^`wKdKJ{O(r?GK&aCd2hc zr3UQBXD2Wj7CHr9fOJeOxpsW<1@UvH%4uj85u1?_17jv(H>~vT@y=xGO6(rV7WLx* zN(kui0IEC*kE5mTW-7wbYU}TF$xooH@!1~H0{f(!xc|Ovc`1+EqBk8`^a0YG@ZoYoyQ z`4kowmkz1&U7iFQgucE(B3tTEo>adh?>jt& zNWA~2X@TW$>)(HCT4*yi?nqoa4v9?7ijInMadAk#IyV-cG(3KX>6zaz(`bEM6>RRNDOn(!yLApnFH3%^GAg~eoa zTH_|4h@ZT><6FVJG+ggM!XN(AlVe4*WL&mi{1~%jar3}ID-HW9iDg`o?R5w?>f|un zFjQrHr9_R4q~PXU)_w5c0k{K&MmZ}!yCZAUyIM#|4&|794dxgc;f|9B_>!OG6PS;- zW?Dvic+=qGW^eWNQ$e;FBB17U@9lmq7oGmQ{>>p3*Fn^m4UcvgDE%!+`fK(x5ljn< zRR~&A5)1Tg11L39pkjBPQ4nuno;5~ki%5@7dtrVO8D?Kplmg!d1;>X3=5p)n?K&BS zpYi9QiLBIjUt~S@$rF05Lj7r&TBsk20GJTrvAaE44U=DXyl#?laM;!CL4*xiMyCn< zVv?U0;?;r~W*lK}6(a)0Z3meWOxhs@BSLm7spM*{#X7YE*B{hhZ%>vL>#e#|C|>^R z(y~>s_Son|;3O2VZP^B;sMpg`i;Kiv^sr|KFSqF?u;Bqh!GuK3DkIUBN`+pu*p(iKc7o3-CN?E@N7E6_Ezh=18BK|4I# zF>yW$(*rdARGP^XWBJovaqZupR-jYjrwu#WkjYP%0kRpRZ7vw;)TZ;n0rG4w5`|X87$}oH6OE=Qorp&pC#?Wftw%o|SIU zfK*otctJDafBCY-zpMiO^?Mor`RIRI;Qw6<1nA#o)Nm)bCBX;gZGSEq$-MS$Itvn; z20F2wEgtqD%UdggMGl0SZp!?LKodwTUFcDE(F1G*s#?pTe-fi{?Q9=j@aSLSbYflXKoy{H=94}8U*ey>h z(2JDb=AX8o^C?LDYKlehuvKC1mjw8(QcU+~3{4yS$niSS3h$3X0GRx_xQsQ908`-C zQOJ@Tn6~>HwS~Y>eh!YM`KCh5$GbnsAZ8!lrIkRXn;4*d&TniW2Tb9&Bu1+&D*3#B zuCL8sJ{zJ4sQUzlO7NDp#-RFg>-=UcUN9CbpJ=b+lYz_H;uN7;x!aF%z*|$LGqbvj zv1HBBP3gbRxhEtHUvfgul!GXGj%lsEJq4jFz2%sXIlhxYE<ol3_pWJSAmFHIzA4w`g!~-UyR$r=W&G-<9<4 z8S7%i4&Cf?qUP*xwNnTJL&V5siSc2q%RZV&;zT&Z^7^b~1^%%JPoKKXhZUj<+P&Hz z;A##qvu1vas9^!dqzVJZ42=9VDx+5zUvE(6^BD3OoTVjJmPMkZ7E1VCPm=dwmiRr| zhZ4~)lkYB8O5U5i9Ge8bamEE}Q6hGDG#mVE*h$611U$zL&VzFi-9XKq2)Ele!{4|) z3-(D_|B=Jg*6#f3ce7LNfFugAwH#sN7Ztb)$?L1v={Vp~TPd)(yC!U-#WZcuwQT#% z4qz>xoAIKIvRpNdsnuew@Fe(vx0Vt6t$cEAeuPcy)%y7~M| z=H28`$R#6q&Z|v7$`~jp<^$;snQB4*4&t+ya_zNi;m>}oP_@_zM;N}}?!Hb}t)eGw*riB6^{ z5Kpo+T-t0U5StU+qrLY>!7OxCfUA{IfBcZ`<}q-+_MEG&c*eYP&pW!#iTH0m1b*D( z+Mvp0TmHEb9|IgA3-)EGN@RL8rnpiqc5_P}djQ|m)$uWsF}9JPkesk)f|K(Y7}+z= z;5E;fPcC`vY&AAmuj|cM-AU*sgKfHm^SpuGUr_>;8b}fhvd})W^cG+?Jn*KYNQGFV z0C(?i;XjLRa{hd`JN6N`A=k4l(k}6B*v>+^7&uC=}D%`Xsc^NfMeS1Ny zyLq7n^7s+G$0xbAm z$XgJ1j(;oyrkiU4>z(sr9U|GKYToC+uuW8PyzJR!~mjQh9 z*oJB_r6%+l>!C~WMt3>p(o3*ev#&2Aj^o?*jl6R8Ji%~+A4beRogTRMefGN+}S$Ez;h9si4mx4*Jc`_u{gDgjH4a<1qb{D)RarX=u1Pf^6Z@vy<#xM8wZ0^>hua8qac=q>oN-Y4IyLKsC#BDoj zHTU1?ePiFodbWXMz>9h)n3kFZZ(M z>gjar=@jteyh*?-Prdd!hbM{<2~}}v%LoCctMhV9GwL$B2HgtglKmQCxc#t0|6E3d z77u5f;y0e@dJjaFNs)TV4?&fT^Q>Hv`wY;bVDQH5?;1~UP!EUn<%Rl${1p-NXJZtOM$iSmt8*$!8@ovi=xg7~{fBn3d6*JcGjK3Bhc1p_>M_!HY= zC8qnce<6Fb8|yoBOn-mgQE(@?;}r`?L0y=n*}>&ULaRp@kU5!){+4+nEsa%6Q}FMv z)R?(xZ$UW5-Qth)J8DLe>u-NN3wOb5k2~wX3o=_#N}*db5%k2>cB4u8{gSk=(QOI* z!RM3Oy4(F-fqlW!(ICf2^m4s4z0Vs#etu3l(XNx+b|ZXf#PbfbYI+tBFzA{92c~`i zH#C)L%H>h9*N9M!Jw4rW_)DvZ#R#Y0rEkSsufusVeMhp^M=R0q4xQoReb6v@E$3 zxR3wl_Zl~$!;g2m+>LUy1jYiknnl1(x!c4#>ZW`6<+c)t2X@@xrs4^Jxj}vONmC_k zB#pYJ$|e8S1PHVNQ)XtV&pVkJR!ns<40&z_{5qn0=$vLA0T&9Oo%j53v*_wR(=xZR zMxpuuwV)Pn#%(LSaKdQGJs_Puyu%DxlE)^oIc)!1(~G}7ls>u_R*)acSZwsz1|-zj z2)ronb(o2*^$6($b`y zEDrI5IBZ`O=)hCa+$KzJ6_F#5x#J~tAVu5PGcdH8utkFbd5q(UbLjX?H{oQJL*3c= ztaZ$%VB}aP`o34l0!sJmKaZ595}Vh+H}#Z0iwnkCR=8u0&2Vz!JnV}kQisHnR78N9yE>anV#l}l^9C=2`{jOV2Rri( zTs{d66}fR#9X5>p8UlH=ar6HIG_(F?%QCMWtx|TV)P~7WQ>T7WXOK*EQ>ErlrZ;1J z8u0TbU~#Ba6C2y#&vL1P2pxp;*co(bzIn~w z;R*t)OA3DdX;T)wAG04j!%D28zWlaF<~XU>?41|}R{-b^3rPBs@?+S;#Z}{r#(vn% zoxTlbhr})trT&Ls>2&GdxdrijKrF+Vz@FG&tz!~Zs!5u&MH5XZ$#fx|L%%w`TI5pa zinLCEzH!2@!(R7{);rCf%uHxQS9r`CtLWR&20+W)+)1^+F)@dq{RpGxsSJ1~YZ~?= zEOuOPi=p*f?(+uCAFY-q8#WQ)44SOin9ngOnZ{ef*`(jzd5-MrK5Z+KV5+sWq!l|2 z9;@JXaqo3;Z%wo4OZ^&G9v}YmnMnG#*wxI{xLkfa74jm=>e8*y$^lVY?7VZqRVA$Fc6KY z5MfbK_N`@oR$xbD%jB~uEA)!V;PE5r&UZhh1TSYZBR|A`i!mmX%1P9qmdV3S)8&dx z%QEM6_=sn2YaskQjh^9AZkoE8hj@7e7pA1OScq}{VX;ek!k6Xbe-=QlCr6F@Q}Q+W z+g1rIx}exj333cN(1Wm*75M=)ZqS{m{PQ^>iplgb`1q6G7fwP+2n4RmX?J%rO8Ss6 zs9Va`MC0BOt14|HWA2*K<#IlL!PGF?+yd4|LXyE@-~Y#Se-QH?)Pd}Qjz!OyZGq+^ ziV$S?gkkLo@z>}1YHh-Ny*A1M^u#1O>f*Mc9=56F>k8&N)#jo*F5=80LspKz!Dsy= z$Fo5ObtIccM*|ne!l@sn7-}F_uJ?V5>*vqo7eZ$6{Drs9uVNy9 zQW!ju)`Ad81}q7aanYJ^V!8*X%9!15Wosqfr9V5)kKWR$8=@i4N`?_N({{JG1xCQRBb z!;47ZXgx>BS=wXAwpv!}3-f}yRH zij+Mh#5D+Dfx}uxcO)V_94|#`BIOPV>)?NN{TFYY-I@2VsTi-`+{13V7H6r}fqdtF z>?p#(UZ!;Y`<~*Aq&zd^?2hrYQupP3j(hZuBK~2lo?3$%cc4M<8`nfgY$^f4yNbGF zysU|<1DSp4`8hOZ%-Aj2?Rw!jVS<(A7Dj-vdE#@!90fctR7cFL9s~94mXX8ZXh__^ zaizV7XBI!C1L|9Ex=4j0_)YvydI1w5Q`M7h@Fjzh9!+_@Z;3 zzWyYLKk}0+x%hxA>*P;qot$3DUxOE7i3uK?MZzg&U(40E`{73W`4R2Ya4mIYv)57b zLmQ{HA^1$99Ul5qeyx9&$Zs5oER(GxQMHH55W z-0eWUc-n{Z`oVJbj?a2m4@BT-OJjA@4YJ`|QMq#wl?Z>80^hq_L576J45QtWoX=ii z$%~%VD1BqKLGC!MIX6dbp3`dW!%PK@;%6i1?MA1B`IPp(m61_bN#L$81zU7Lgsu;1 zy4fh`T`4F=?gn^m{@#bo;52ovzukOcc59GEFJc`}yW}oTt8vS{R}E1m5${&|IUu(& zc|^$8};87@?u8jYs?46{%G5@FI%zfOZ7kM@CBD}hqfo4&%wURZOC&sUF31U zYKR?D^RZTLRu%*}e{sCns5km|3Ix=DM22j4x(6G%LVOwhcMRVCBy`4a zYPEYLRUoe93~|wwBywGwe0;dr^L~2b>1bbH%?jT&L>o~F8Bb&*k9*~_QobFdqTV)? z8lNVf2f8gBc6S)XeUrpP`BQkIGzo57?VtWa?%cnN%#M2IIYy8zj8FBY-flCiPi$V$ zWxM|oZkKgmYOj77g~TYo4Q(jlQ44s8hmA2N8t4p_TC2}1EKn#n=(go~mOVAI~62K8i%EE;F`mywD{p+{~ zv05OfKOy9dSLXEf_=WIF^c@IyXfP3Q3rb%RuK*q#oLA=0f`a;Q#$ z+7er$L{ZV2T7f54l#rwKNF^BI1@|P+htw9-F7X$K<%k$L42jjzS9RfRh)iV*TdYv^ z$lcY(mIn};_r`j6vI#z9Q9-;tno=K(!ugM+r*$FyMLNO!u&3E_F*I*H`^>il+P*)| ziS_8#(U}l;=oJ1<8?f?szr2I!c&zAlKckV;mUw{OggkUPT!=we&?HELeU*p8OX9mA zi-N~>U4PGX<``v+7+T$h6+eJ|KXU9^>Y!-)0DsGa;;3?GA-Ii2D_~V)K;^jE-&k5E zlwWtxx?)8;RVt$)amO!I%&)>iDTSMMmGo_!EK4Y^sdnPn`auD^lZGI&5}Xx}jKhJz z*F^XGwD2j@YaNPz5y`k*CjZ=rQlajx_ofY{D>gB3)6~0+o&#QGzKR)f7u1z^U zTs=5A(kdn?{%EX|soL@CX{l1$a+=Wc4l)VBfW6afB#AD9CK=6 z&L<^83=|S4A$Zk3CuF-bxBh%;p@~S6ud4@^Aa|I>d{^a%blhZszCys{=yetPrdU1H3@3ZegEm(E_0%KHer()i#?MZH-jLQEs>y;L5tdkTL-(qO^ zFryX3MzR1QhEA_;ZJp5QjV!t4;)eX_s9Sxnef=6=(BP0hD%5&R=;h6&nwP6Y4GfvM zNF|`;vH!7q7E%6AJ(M2ASk;Bit~_4bE=}?X5)#Aw=xBEuUfI!xK;Zbg!-9=0&bjJ` zW6dd%FseQ!;%7rbG%ML5MN(jMKULxu~ea ztRZ~Dr4dV8T-;98B&?!JDSbo8D}T9SWw>Jt56yD+N=+>yY0RL;va>z*-W_nI6Yt%j zu+IUpmuyp#7Qm4_V~^nmcH+*};J1 zus7xOx1THtpYc94y{8>R61?x*_$K;Z+e;=0BrEUxn~dJGOF8KbSxt7T<+Yj0+lzgx zYP7|b?8XhxCKvEHzv39K-ZT2CZM6%-4C?KLbWcpwHGUU#Qze3Sa+$q+v|oELO~<~- zn2#38SNzmB@nEI8SE#Bn`I~i>lK~AO*fL>Fm99UN9?jb?C1!EU@X}yG#Ncrp6*^#&)unJauQ_JIFj4p%S=L-dRDnyTe`PPS(wwPdh`;9eA%7Q_o>d%xk zJ0jk;016dqaN`C{8Pux(AB~!MG?e=rz(>T?5T&lMjIo4V85&s{BReIRNKBRpk(e1W zw#YhmLK$Ok(b$QS!cgvDgwcYzjInPc%aATVvfQ_O&hP*G?|a_&obUHM=Xsvb^Ld{{ z2nwXr$`h?DPYdNDmKNyUvp`c{8F_suz7Pxi%YNZA-p;E~s~_?Sw^H$#I^t(xtwAXx zW9H$ZH$^2&IA7$KM)967)I1UUrf(DT%8pgtghE-sV3Z5LEok{#C3C%?W+992%>1DP z%DP+!5}&nMZ|_z}17W!Jr+%8w>qL-riO<%&sS|CNiTE zyZ(*DR}oc-nNgR}9~~&VpBcxC2sc#~qq4z*aWmGsnFAUDDyLK>oRq?(l@J(LB}Lw7 zJTJ&Uz{J4UL{SDQjVHvKIEOKmaZ}c7e*>R}nyswX<{7DP! z1UF`3Fe?#Q@**q`n8QSYlr_z%@^GJp=_)q|YfvbQk6#YsTs99P&o9jC2uXP6%{Dk* zWAWPT?c~S^g{&q?Zi79UHcwasN2;Ton4et9p$WacLlf_&(Dw!9PXalj95C1QbF1NU za`VPQPc{Msvio9Vq#ZI>cl=OZ-y@$RvqynCV9h+pZrW72J`1Nd$?(jneq;`Kn@ZT? zl3S^1!e7s3L9+Xewj4Wk^>u2x3X2#%gLx{(o#W|+^mOw@Cjk(-pz4Z6wg4Yc6E*46 zDN&Pi4|kwoSp&{bV5-1JCdu^fL8k-ur0pX>7a$i>W5(9TaA!Qr7h;}l8p?Ggm5KGA z6U@PzeKXG0iP(eWYnl9{j4B-ypja66c_hf(n`UN@#qL0L$J-C zC#MG#o$n0z@PX~}-f_M_TF=hhyeSPvPcrEW4}tBpDu+{AacrnYCeXu{vMT_j8cD#kq)#n{VF0tI5TQFlD0UW&p;qKJBL5|ucdcv=fvVx%f&@GVd1&%FWd2|4yGufV_v6EV2vVHS6xzy zTkom~Ge+SE|KNZ;b;H2r+;rJIR!0ZbSRh+gmL*CLA|rAdgFpZUj?MSoCjPmcF4 z(YgxfmF2s`1c%#Cle~r{Q~#dw&-9>`9p2Ic7bTqIt&7y3ua37&S-DazzYhXK&laWC z9LF>r#^$>XEF3NxZbccKA*PC=$b{0Ta?9zR?3a*zM43Se?K>m1L=^Rg*rHJy?>1n_ zrs7rgsoE!z5&QB8irc#94+sb}!9Uyx_R{c*jIRS*LfUuhDNN|#skm@AI(!&gmC+i@ zQFFboK3a(F*ngkEVN`r|5O> z;EH}w$S#VOd;p;QoT|=CGnu}KkJ%`rZ;_~Wcmw)5fI?FJT&21A^W1u_L2oqDu$OB4mREjJ=UiRN#!O4`&c`HgZ*m0^oY~{*D>FX z+z3OQye8A^bB*8Fe3CuT#x~Tre9EBI+^aZ1-*iI^?|rkqo_Mtq*=7GrI*HS)1`C$O z_;r*j6LV-azz#-vXa+#K6f-hn@VMHHB@Ro54 z@u+vky(38?wnfRvK+kouWvxZ+LrIIUT{i^}0{`MVq!to&LSbU+-6Ob#9Y)hHR_GI} z`E2oJ9r)87xNy_gj>*3D}Z^V7Xs_WKT) z8#^mDjC?m^1`f7;Fnt3!@4vI`)tj#3*US0Owoicbfxhi#TllA6yq$w&P+C zQ0$2!?r;Eq0Vh_U@ypEo_s@@MK<~3Oe@Qiqc6BMJr~nw6l~deh^-H%sQb+S0GLvx! sCA~Ot`8wVB*R#7swVjNGu>Av24%%~A-~R`&Fa!c!HnlRTHFAsn2T6Ep(f|Me literal 0 HcmV?d00001 From 56eb54bd3b7a0603a0b7da1dd4c20f1679de6bee Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vin=C3=ADcius=20Fontoura?= Date: Tue, 3 Dec 2024 09:53:52 -0300 Subject: [PATCH 3/9] [add] reforcing the need to click on the save button when creating the first user-key --- docs/models/userkey.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/models/userkey.md b/docs/models/userkey.md index b3213d5..ea37cef 100644 --- a/docs/models/userkey.md +++ b/docs/models/userkey.md @@ -19,14 +19,16 @@ Private key formats supported (unencrypted) - PKCS#1 RSAPrivateKey** (PEM header: BEGIN RSA PRIVATE KEY) - PKCS#8 PrivateKeyInfo* (PEM header: BEGIN PRIVATE KEY) - ## Creating the First User Key When NetBox is first installed, it contains no encryption keys. Before it can store secrets, a user (typically the superuser) must create a user key. This can be done by navigating to Netbox Secrets > User Key. To create a user key, you can either generate a new RSA key pair, or upload the public key belonging to a pair you -already have. If generating a new key pair, **you must save the private key** locally before saving your new user key. +already have. If generating a new key pair, **you must click on the `I Saved My New Private Key` button** to properly save it. + +![first-user-key.png](../../assets/first-user-key.png) + Once your user key has been created, its public key will be displayed under your User Key page. When the first user key is created in NetBox, a random master encryption key is generated automatically. This key is From d31022bc613b76d14cfa89bba49c4c33489b6b81 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vin=C3=ADcius=20Fontoura?= Date: Tue, 3 Dec 2024 09:54:17 -0300 Subject: [PATCH 4/9] [add] summary & reference to user-key documentation --- README.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/README.md b/README.md index 82fe84f..d6d821d 100644 --- a/README.md +++ b/README.md @@ -5,6 +5,17 @@ is minimally maintained and has a lot of issues. This plugin is a complete rewri and flexible than the original plugin. It is also regularly tested with the latest NetBox releases to ensure compatibility and stability. +## Doc Summary + +* [Features](#features) +* [Compatibility](#compatibility) +* [Installation](#installation) +* [Configuration](#configuration) +* [Extra Configuration](#extra-configuration) +* [User Keys](#user-keys) +* [Screenshots](#screenshots) +* [FAQ](#faq) + ## Features * Store secrets in the database encrypted with a public key (RSA) @@ -84,6 +95,14 @@ The following options are inherited from NetBox to configure the cookies: __Note: These options should be set in the NetBox configuration file.__ +## User Keys + +Each user within NetBox can associate his or her account with an RSA public key. If activated by an administrator, this user key will contain a unique, encrypted copy of the AES master key needed to retrieve secret data. + +User keys may be created by users individually, however they are of no use until they have been activated by a user who already possesses an active user key. + +For more information on user keys, please refer to the [User Key](./docs/models/userkey.md) documentation. + ## Screenshots ### User key (Without Session) From 49fa3cae7119693c17519f948a648ce60ad8fb48 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vin=C3=ADcius=20Fontoura?= Date: Tue, 17 Dec 2024 13:22:54 -0300 Subject: [PATCH 5/9] [change] every `docs` file into the `Readme.md` file [add] table of contents & Pynetbox usage topics --- README.md | 354 +++++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 351 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index d6d821d..bcf5955 100644 --- a/README.md +++ b/README.md @@ -5,13 +5,33 @@ is minimally maintained and has a lot of issues. This plugin is a complete rewri and flexible than the original plugin. It is also regularly tested with the latest NetBox releases to ensure compatibility and stability. -## Doc Summary +## Table of Contents * [Features](#features) * [Compatibility](#compatibility) * [Installation](#installation) * [Configuration](#configuration) * [Extra Configuration](#extra-configuration) +* [Usage](#usage) + * [User Keys](#user-keys) + * [Supported Key Format](#supported-key-format) + * [Creating the First User Key](#creating-the-first-user-key) + * [Creating Additional User Keys](#creating-additional-user-keys) + * [Secret Roles](#secret-roles) + * [Secrets](#secrets) +* [API](#api) + * [Generating a Session Key](#generating-a-session-key) + * [Depracated Endpoint](#depracated-endpoint) + * [Retrieving Secrets](#retrieving-secrets) + * [Creating and Updating Secrets](#creating-and-updating-secrets) +* [Pynetbox](#pynetbox) + * [Generating RSA Key Pair](#generating-rsa-key-pair) + * [Activating User Key](#activating-user-key) + * [Generating Session Key](#generating-session-key) + * [Retrieving Session Key](#retrieving-session-key) + * [Creating Secrets](#creating-secrets) + * [Retrieving Secrets](#retrieving-secrets) + * [Updating Secrets](#updating-secrets) * [User Keys](#user-keys) * [Screenshots](#screenshots) * [FAQ](#faq) @@ -95,14 +115,342 @@ The following options are inherited from NetBox to configure the cookies: __Note: These options should be set in the NetBox configuration file.__ -## User Keys +## Usage -Each user within NetBox can associate his or her account with an RSA public key. If activated by an administrator, this user key will contain a unique, encrypted copy of the AES master key needed to retrieve secret data. +### User Keys + +Each user within NetBox can associate their account with an RSA public key. If activated by an administrator, this user key will contain a unique, encrypted copy of the AES master key needed to retrieve secret data. User keys may be created by users individually, however they are of no use until they have been activated by a user who already possesses an active user key. For more information on user keys, please refer to the [User Key](./docs/models/userkey.md) documentation. +#### Supported Key Format + +Public key formats supported + +* PKCS#1 RSAPublicKey* (PEM header: BEGIN RSA PUBLIC KEY) +* X.509 SubjectPublicKeyInfo** (PEM header: BEGIN PUBLIC KEY) +* __OpenSSH line format is not supported.__ + +Private key formats supported (unencrypted) + +* PKCS#1 RSAPrivateKey** (PEM header: BEGIN RSA PRIVATE KEY) +* PKCS#8 PrivateKeyInfo* (PEM header: BEGIN PRIVATE KEY) + +#### Creating the First User Key + +When NetBox is first installed, it contains no encryption keys. Before it can store secrets, a user +(typically the superuser) must create a user key. This can be done by navigating to Netbox Secrets > User Key. + +To create a user key, you can either generate a new RSA key pair, or upload the public key belonging to a pair you +already have. If generating a new key pair, __you must click on the `I Saved My New Private Key` button__ to properly save it. + +![first-user-key.png](../../assets/first-user-key.png) + +Once your user key has been created, its public key will be displayed under your User Key page. + +When the first user key is created in NetBox, a random master encryption key is generated automatically. This key is +then encrypted using the public key provided and stored as part of your user key. __The master key cannot be recovered__ +without your private key. + +Once a user key has been assigned an encrypted copy of the master key, it is considered activated and can now be used +to encrypt and decrypt secrets. + +#### Creating Additional User Keys + +Any user can create his or her user key by generating or uploading a public RSA key. However, a user key cannot be used +to encrypt or decrypt secrets until it has been activated with an encrypted copy of the master key. + +Only an administrator with an active user key can activate other user keys. To do so, access the NetBox admin UI and +navigate to Admin > NetBox Secrets > User Keys. Select the user key(s) to be activated, and select +"activate selected user keys" from the action dropdown. You will need to provide your private key in order to decrypt +the master key. A copy of the master key is then encrypted using the public key associated with the user key being activated. + +### Secret Roles + +Each secret is assigned a functional role which indicates what it is used for. Secret roles are customizable. + +Typical roles might include: + +* Login credentials +* SNMP community strings +* RADIUS/TACACS+ keys +* IKE key strings +* Routing protocol shared secrets + +### Secrets + +A secret represents a single credential or other sensitive string of characters which must be stored securely. Each +secret is assigned to a device within NetBox. The plaintext value of a secret is encrypted to a ciphertext +immediately prior to storage within the database using a 256-bit AES master key. A SHA256 hash of the plaintext is also +stored along with each ciphertext to validate the decrypted plaintext. + +Each secret can also store an optional name parameter, which is not encrypted. This may be useful for storing usernames. + +## API + +As with most other objects, the REST API can be used to view, create, modify, and delete secrets. However, additional +steps are needed to encrypt or decrypt secret data. + +### Generating a Session Key + +In order to encrypt or decrypt secret data, a session key must be attached to the API request. To generate a session key, +send an authenticated request to the `/api/plugins/secrets/session-keys/` endpoint with the private RSA key which +matches your [UserKey](../models/userkey.md). Place the private RSA key in a json file. + +```no-highlight +$ curl -X POST http://netbox/api/plugins/secrets/session-keys/ \ +-H "Authorization: Token $TOKEN" \ +-H "Accept: application/json; indent=4" \ +-H "Content-Type: application/json" \ +--data @ +``` + +```json +{ + "pk": 7, + "id": 7, + "url": "http://netbox/api/plugins/secrets/session-keys/7/", + "display": "admin (RSA)", + "userkey": { + "id": 1, + "url": "http://netbox/api/plugins/secrets/user-keys/1/", + "display": "admin" + }, + "session_key": "4H8MCOl98qom7Ug5fQTzsFcH600SRWxe7KlUyIYxJ+A=", + "created": "2023-05-07T20:29:38.089884Z" +} +``` + +!!! note + To read the private key from a file, use the convention above. Alternatively, the private key can be read from an +environment variable using `--data "{\"private_key\": \"$PRIVATEKEY\"}"`. + +Use the following CLI command to convert your PEM RSA key to json: + +```no-highlight +jq -sR . +``` + +The request uses the provided private key to unlock your stored copy of the master key and generate a temporary +session key, which can be attached in the `X-Session-Key` header of future API requests. + +### Depracated Endpoint + +If you still want to use `application/x-www-form-urlencoded` you can use the __depracated__ API endpoint +`http://netbox/api/plugins/secrets/get-session-key/`. + +```no-highlight +curl -X POST https://netbox-test.tugraz.at/api/plugins/secrets/get-session-key/ \ +-H "Authorization: Token $TOKEN" \ +-H "Accept: application/json; indent=4" \ +--data-urlencode "private_key@" +``` + +```json +{ + "session_key": "4H8MCOl98qom7Ug5fQTzsFcH600SRWxe7KlUyIYxJ+A=" +} +``` + +### Retrieving Secrets + +A session key is not needed to retrieve unencrypted secrets: The secret is returned like any normal object with its +`plaintext` field set to null. + +```no-highlight +$ curl http://netbox/api/plugins/secrets/secrets/2587/ \ +-H "Authorization: Token $TOKEN" \ +-H "Accept: application/json; indent=4" +``` + +```json +{ + "id": 2587, + "url": "http://netbox/api/plugins/secrets/secrets/2587/", + "display": "admin", + "assigned_object_type": "dcim.device", + "assigned_object_id": 1827, + "assigned_object": { + "id": 1827, + "url": "http://netbox/api/dcim/devices/1827/", + "display": "MyTestDevice", + "name": "MyTestDevice" + }, + "role": { + "id": 4, + "url": "http://netbox/api/plugins/secrets/secret-roles/4/", + "display": "Login Credentials", + "name": "Login Credentials", + "slug": "login-creds" + }, + "name": "admin", + "plaintext": null, + "hash": "pbkdf2_sha256$1000$G6mMFe4FetZQ$f+0itZbAoUqW5pd8+NH8W5rdp/2QNLIBb+LGdt4OSKA=", + "tags": [], + "custom_fields": {}, + "created": "2022-12-30T21:25:17.335575Z", + "last_updated": "2022-12-30T21:25:17.335619Z" +} +``` + +To decrypt a secret, we must include our session key in the `X-Session-Key` header when sending the `GET` request: + +```no-highlight +$ curl http://netbox/api/plugins/secrets/secrets/2587/ \ +-H "Authorization: Token $TOKEN" \ +-H "Accept: application/json; indent=4" \ +-H "X-Session-Key: dyEnxlc9lnGzaOAV1dV/xqYPV63njIbdZYOgnAlGPHk=" +``` + +```json +{ + "id": 2587, + "url": "http://netbox/api/plugins/secrets/secrets/2587/", + "display": "admin", + "assigned_object_type": "dcim.device", + "assigned_object_id": 1827, + "assigned_object": { + "id": 1827, + "url": "http://netbox/api/dcim/devices/1827/", + "display": "MyTestDevice", + "name": "MyTestDevice" + }, + "role": { + "id": 4, + "url": "http://netbox/api/plugins/secrets/secret-roles/4/", + "display": "Login Credentials", + "name": "Login Credentials", + "slug": "login-creds" + }, + "name": "admin", + "plaintext": null, + "hash": "pbkdf2_sha256$1000$G6mMFe4FetZQ$f+0itZbAoUqW5pd8+NH8W5rdp/2QNLIBb+LGdt4OSKA=", + "tags": [], + "custom_fields": {}, + "created": "2022-12-30T21:25:17.335575Z", + "last_updated": "2022-12-30T21:25:17.335619Z" +} +``` + +Multiple secrets within a list can be decrypted in this manner as well: + +```no-highlight +$ curl http://netbox/api/plugins/secrets/secrets/?limit=3 \ +-H "Authorization: Token $TOKEN" \ +-H "Accept: application/json; indent=4" \ +-H "X-Session-Key: dyEnxlc9lnGzaOAV1dV/xqYPV63njIbdZYOgnAlGPHk=" +``` + +```json +{ + "count": 3482, + "next": "http://netbox/api/plugins/secrets/secrets/?limit=3&offset=3", + "previous": null, + "results": [ + { + "id": 2587, + "plaintext": "foobar", + ... + }, + { + "id": 2588, + "plaintext": "MyP@ssw0rd!", + ... + }, + { + "id": 2589, + "plaintext": "AnotherSecret!", + ... + }, + ] +} +``` + +To get a list of secrets from the assigned object + +```no-highlight +$ curl http://netbox/api/plugins/secrets/secrets/?assigned_object_type=dcim.device&assigned_object_id=103 \ +-H "Authorization: Token $TOKEN" \ +-H "Accept: application/json; indent=4" \ +-H "X-Session-Key: dyEnxlc9lnGzaOAV1dV/xqYPV63njIbdZYOgnAlGPHk=" +``` + +```json +{ + "count": 2, + "next": "http://netbox/api/plugins/secrets/secrets/?limit=3&offset=3", + "previous": null, + "results": [...] +} +``` + +### Creating and Updating Secrets + +Session keys are required when creating or modifying secrets. The secret's `plaintext` attribute is set to its +non-encrypted value, and NetBox uses the session key to compute and store the encrypted value. + +```no-highlight +$ curl -X POST http://netbox/api/secrets/secrets/ \ +-H "Content-Type: application/json" \ +-H "Authorization: Token $TOKEN" \ +-H "Accept: application/json; indent=4" \ +-H "X-Session-Key: dyEnxlc9lnGzaOAV1dV/xqYPV63njIbdZYOgnAlGPHk=" \ +--data '{"assigned_object_id": 1827, "assigned_object_type": "dcim.device", "role": 1, "name": "backup", "plaintext": "Drowssap1"}' +``` + +```json +{ + "id": 6194, + "url": "http://netbox/api/plugins/secrets/secrets/9194/", + "display": "admin", + "assigned_object_type": "dcim.device", + "assigned_object_id": 1827, + "assigned_object": { + "id": 1827, + "url": "http://netbox/api/dcim/devices/1827/", + "display": "device43", + "name": "device43" + }, + "role": { + "id": 4, + "url": "http://netbox/api/plugins/secrets/secret-roles/4/", + "display": "Login Credentials", + "name": "Login Credentials", + "slug": "login-creds" + }, + "name": "admin", + "plaintext": null, + "hash": "pbkdf2_sha256$1000$J9db8sI5vBrd$IK6nFXnFl+K+nR5/KY8RSDxU1skYL8G69T5N3jZxM7c=", + "tags": [], + "custom_fields": {}, + "created": "2022-12-30T21:25:17.335575Z", + "last_updated": "2022-12-30T21:25:17.335619Z" +} +``` + +!!! note + Don't forget to include the `Content-Type: application/json` header when making a POST or PATCH request. + +## Pynetbox + +The `pynetbox` library can be used to interact with the NetBox API as well. Here are some examples of how to use `pynetbox` to interact with the NetBox Secrets plugin. + +### Generating RSA Key Pair + +### Activating User Key + +### Generating Session Key + +### Retrieving Session Key + +### Creating Secrets + +### Retrieving Secrets + +### Updating Secrets + ## Screenshots ### User key (Without Session) From 0e83f026fcf8b1b4f9662026b1dac6055cc520ab Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vin=C3=ADcius=20Fontoura?= Date: Tue, 17 Dec 2024 15:18:00 -0300 Subject: [PATCH 6/9] [todo] test each pynetbox example [add] Pynetbox examples --- README.md | 293 +++++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 292 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index bcf5955..8127a52 100644 --- a/README.md +++ b/README.md @@ -437,20 +437,311 @@ $ curl -X POST http://netbox/api/secrets/secrets/ \ The `pynetbox` library can be used to interact with the NetBox API as well. Here are some examples of how to use `pynetbox` to interact with the NetBox Secrets plugin. +For more information on `pynetbox`, please refer to the [pynetbox documentation](https://pynetbox.readthedocs.io/en/latest/). + ### Generating RSA Key Pair +You can use the `/api/plugins/secrets/generate-rsa-key-pair/` endpoint to generate a new RSA key pair. The keys are returned in PEM format. + +```json +{ + "public_key": "", + "private_key": "" +} +``` + +To generate a new RSA key pair, using `pynetbox`, you can use the following code: + +```python +import pynetbox + +nb = pynetbox.api("netbox_url", token="your_netbox_token") + +key_pair = nb.plugins.secrets.generate_rsa_key_pair.create() +``` + +The `key_pair` variable will contain the public and private keys in PEM format. + ### Activating User Key +To activate a user key, you can use the `/api/plugins/secrets/activate-user-key/` endpoint. The endpoint requires the private key in PEM format. + +```json +{ + "private_key": "" +} +``` + +To activate a user key, using `pynetbox`, you can use the following code: + +```python +import pynetbox + +nb = pynetbox.api("netbox_url", token="your_netbox_token") + +nb.plugins.secrets.activate_user_key.create(private_key="") +``` + +The user key will be activated and can now be used to encrypt and decrypt secrets. + ### Generating Session Key -### Retrieving Session Key +To generate a session key, you can use the `/api/plugins/secrets/session-keys/` endpoint. The endpoint requires the private key in PEM format. + +```json +{ + "private_key": "" +} +``` + +To generate a session key, using `pynetbox`, you can use the following code: + +```python +import pynetbox + +nb = pynetbox.api("netbox_url", token="your_netbox_token") + +session_key = nb.plugins.secrets.session_keys.create(private_key="") +``` + +The `session_key` variable will contain the session key. The session key can now be used to encrypt and decrypt secrets. ### Creating Secrets +To create a secret, you can use the `/api/plugins/secrets/secrets/` endpoint. The endpoint requires the session key in the `X-Session-Key` header. The data sent needs to be in the following format: + +```json +{ + "assigned_object_type": "string", + "assigned_object_id": 2147483647, + "role": { + "name": "string", + "slug": "8M0SQnM8j0Y3Bto4c7SEs3w_2bvxF1SK9UFFRVSUfzW5CdD12Ro3o-ecA7yJP3OkHgvSy1zlsV84DgKNh2J02-578Q4Tvg0KsOe" + }, + "name": "string", + "plaintext": "string", + "description": "string", + "comments": "string", + "tags": [ + { + "name": "string", + "slug": "3iRRVSvfqln", + "color": "392511" + } + ], + "custom_fields": { + "additionalProp1": "string", + "additionalProp2": "string", + "additionalProp3": "string" + } +} +``` + +To create a secret, using `pynetbox`, you can use the following code: + +```python +import pynetbox +import requests + +nb = pynetbox.api("netbox_url", token="your_netbox_token") + +# retrieving the session key +session_key = nb.plugins.secrets.session_keys.create(private_key="") +session_key = dict(session_key)["session_key"] + +# updating the session key in the headers +session = requests.Session() +session.headers.update({"X-Session-Key": session_key}) +nb.http_session = session + +# creating the secret +secret = { + "assigned_object_type": "dcim.device", + "assigned_object_id": 2147483647, + "role": { + "name": "Login Credentials", + "slug": "login-creds" + }, + "name": "admin", + "plaintext": "foobar", + "description": "Secret description", + "comments": "Secret comments", + "tags": [ + { + "name": "tag1", + "slug": "tag1", + "color": "392511" + } + ], + "custom_fields": { + "additionalProp1": "string", + "additionalProp2": "string", + "additionalProp3": "string" + } +} + +nb.plugins.secrets.secrets.create(data=secret, session=session) +``` + +The secret will be created and stored in the database. + ### Retrieving Secrets +To retrieve a secret, you can use the `/api/plugins/secrets/secrets/` endpoint. The endpoint requires the session key in the `X-Session-Key` header. The request response will be in the following format: + +```json +{ + "count": 123, + "next": "http://api.example.org/accounts/?offset=400&limit=100", + "previous": "http://api.example.org/accounts/?offset=200&limit=100", + "results": [ + { + "id": 0, + "url": "string", + "display": "string", + "assigned_object_type": "string", + "assigned_object_id": 2147483647, + "assigned_object": "string", + "role": { + "id": 0, + "url": "string", + "display": "string", + "name": "string", + "slug": "-1I3G456vZL6V-BMG9h6xUQnn0VvDnJurSIlXQUtrmOe_boEVC3ukZ6aTHG2paF3edk2", + "secret_count": 0 + }, + "name": "string", + "plaintext": "string", + "hash": "string", + "description": "string", + "comments": "string", + "tags": [ + { + "id": 0, + "url": "string", + "display_url": "string", + "display": "string", + "name": "string", + "slug": "grVx7xdVuWSpKEKQYHori6vnZfbkKqyHm-yi", + "color": "26c174" + } + ], + "custom_fields": { + "additionalProp1": "string", + "additionalProp2": "string", + "additionalProp3": "string" + }, + "created": "2024-12-17T16:49:28.698Z", + "last_updated": "2024-12-17T16:49:28.698Z" + } + ] +} +``` + +To retrieve a secret, using `pynetbox`, you can use the following code: + +```python +import pynetbox +import requests + +nb = pynetbox.api("netbox_url", token="your_netbox_token") + +# retrieving the session key +session_key = nb.plugins.secrets.session_keys.create(private_key="") +session_key = dict(session_key)["session_key"] + +# updating the session key in the headers +session = requests.Session() +session.headers.update({"X-Session-Key": session_key}) +nb.http_session = session + +# retrieving the secret +secrets = nb.plugins.secrets.secrets.all(session=session) +``` + +The `secrets` variable will contain a list of secrets. + ### Updating Secrets +To update a secret, you can use the `/api/plugins/secrets/secrets//` endpoint where the `` is the . The endpoint requires the session key in the `X-Session-Key` header. The data sent needs to be in the following format: + +```json +{ + "assigned_object_type": "string", + "assigned_object_id": 2147483647, + "role": { + "name": "string", + "slug": "8M0SQnM8j0Y3Bto4c7SEs3w_2bvxF1SK9UFFRVSUfzW5CdD12Ro3o-ecA7yJP3OkHgvSy1zlsV84DgKNh2J02-578Q4Tvg0KsOe" + }, + "name": "string", + "plaintext": "string", + "description": "string", + "comments": "string", + "tags": [ + { + "name": "string", + "slug": "3iRRVSvfqln", + "color": "392511" + } + ], + "custom_fields": { + "additionalProp1": "string", + "additionalProp2": "string", + "additionalProp3": "string" + } +} +``` + +To update a secret, using `pynetbox`, you can use the following code: + +```python + +import pynetbox +import requests + +nb = pynetbox.api("netbox_url", token="your_netbox_token") + +# retrieving the session key + +session_key = nb.plugins.secrets.session_keys.create(private_key="") +session_key = dict(session_key)["session_key"] + +# updating the session key in the headers +session = requests.Session() +session.headers.update({"X-Session-Key": session_key}) +nb.http_session = session + +# updating the secret +secret = { + "assigned_object_type": "dcim.device", + "assigned_object_id": 2147483647, + "role": { + "name": "Login Credentials", + "slug": "login-creds" + }, + "name": "admin", + "plaintext": "foobar", + "description": "Secret description", + "comments": "Secret comments", + "tags": [ + { + "name": "tag1", + "slug": "tag1", + "color": "392511" + } + ], + "custom_fields": { + "additionalProp1": "string", + "additionalProp2": "string", + "additionalProp3": "string" + } +} + +nb.plugins.secrets.secrets.update(id=1, data=secret, session=session) +``` + +The secret will be updated in the database. + ## Screenshots ### User key (Without Session) From 9021edd58758c97e977df6489d65836cc86b861c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vin=C3=ADcius=20Fontoura?= Date: Wed, 18 Dec 2024 11:12:44 -0300 Subject: [PATCH 7/9] [update] better readibility & rephrasing some text --- README.md | 123 +++++++++++++++--------------------------------------- 1 file changed, 34 insertions(+), 89 deletions(-) diff --git a/README.md b/README.md index 8127a52..3366f3a 100644 --- a/README.md +++ b/README.md @@ -12,7 +12,7 @@ and stability. * [Installation](#installation) * [Configuration](#configuration) * [Extra Configuration](#extra-configuration) -* [Usage](#usage) +* [GUI Usage](#gui-usage) * [User Keys](#user-keys) * [Supported Key Format](#supported-key-format) * [Creating the First User Key](#creating-the-first-user-key) @@ -25,13 +25,12 @@ and stability. * [Retrieving Secrets](#retrieving-secrets) * [Creating and Updating Secrets](#creating-and-updating-secrets) * [Pynetbox](#pynetbox) - * [Generating RSA Key Pair](#generating-rsa-key-pair) - * [Activating User Key](#activating-user-key) - * [Generating Session Key](#generating-session-key) - * [Retrieving Session Key](#retrieving-session-key) - * [Creating Secrets](#creating-secrets) - * [Retrieving Secrets](#retrieving-secrets) - * [Updating Secrets](#updating-secrets) + * [Generating RSA Key Pair using Pynetbox](#generating-rsa-key-pair-using-pynetbox) + * [Activating User Key using Pynetbox](#activating-user-key-using-pynetbox) + * [Generating Session Key using Pynetbox](#generating-session-key-using-pynetbox) + * [Creating Secrets using Pynetbox](#creating-secrets-using-pynetbox) + * [Retrieving Secrets using Pynetbox](#retrieving-secrets-using-pynetbox) + * [Updating Secrets using Pynetbox](#updating-secrets-using-pynetbox) * [User Keys](#user-keys) * [Screenshots](#screenshots) * [FAQ](#faq) @@ -113,18 +112,16 @@ The following options are inherited from NetBox to configure the cookies: * __Type__: `Integer` * __Description__: [Login Timeout](https://docs.netbox.dev/en/stable/configuration/security/#login_timeout) -__Note: These options should be set in the NetBox configuration file.__ +__Note: These options should be set in the NetBox configuration file, not in the `netbox-secrets` plugin configuration.__ -## Usage +## GUI Usage ### User Keys -Each user within NetBox can associate their account with an RSA public key. If activated by an administrator, this user key will contain a unique, encrypted copy of the AES master key needed to retrieve secret data. +Each user within NetBox can associate their account with an RSA public key. If activated by an administrator, this user key will contain a unique, encrypted, copy of the AES master key needed to retrieve secret data. Have in mind that the key activation by an administrator is a __one-time operation__. User keys may be created by users individually, however they are of no use until they have been activated by a user who already possesses an active user key. -For more information on user keys, please refer to the [User Key](./docs/models/userkey.md) documentation. - #### Supported Key Format Public key formats supported @@ -141,16 +138,16 @@ Private key formats supported (unencrypted) #### Creating the First User Key When NetBox is first installed, it contains no encryption keys. Before it can store secrets, a user -(typically the superuser) must create a user key. This can be done by navigating to Netbox Secrets > User Key. +(typically the superuser) must create a user key. This can be done by navigating to `Plugins > Secrets > User Keys`. -To create a user key, you can either generate a new RSA key pair, or upload the public key belonging to a pair you -already have. If generating a new key pair, __you must click on the `I Saved My New Private Key` button__ to properly save it. +To create a user key, you can either generate a new RSA key pair using the GUI, or upload the public key belonging to a pair you +already have. If generating a new key pair, through the GUI, __you must click on the `I Saved My New Private Key` button__ to properly save it! -![first-user-key.png](../../assets/first-user-key.png) +![first-user-key.png](./assets/first-user-key.png) -Once your user key has been created, its public key will be displayed under your User Key page. +Once your key pair has been created, its public key will be displayed under your `User Keys` page. -When the first user key is created in NetBox, a random master encryption key is generated automatically. This key is +When the __first user key__ is created in NetBox, a random master encryption key is generated automatically. This key is then encrypted using the public key provided and stored as part of your user key. __The master key cannot be recovered__ without your private key. @@ -159,17 +156,16 @@ to encrypt and decrypt secrets. #### Creating Additional User Keys -Any user can create his or her user key by generating or uploading a public RSA key. However, a user key cannot be used +Any user can create their user key by generating or uploading a public RSA key. However, a user key cannot be used to encrypt or decrypt secrets until it has been activated with an encrypted copy of the master key. -Only an administrator with an active user key can activate other user keys. To do so, access the NetBox admin UI and -navigate to Admin > NetBox Secrets > User Keys. Select the user key(s) to be activated, and select -"activate selected user keys" from the action dropdown. You will need to provide your private key in order to decrypt -the master key. A copy of the master key is then encrypted using the public key associated with the user key being activated. +Only an administrator with an __active user key__ can activate other user keys. To do so, navigate to Plugins > Secrets > User Keys. Select the user key(s) to be activated, and select +`activate selected user keys` at the top right corner. You will need to provide your private key in order to decrypt +the master key. A copy of the master key is then encrypted using the public key associated with the user key being activated and associated with the selected key(s). ### Secret Roles -Each secret is assigned a functional role which indicates what it is used for. Secret roles are customizable. +Each secret is, necessarily, assigned a functional `role` which indicates what it is used for. `Secret roles` are customizable. Typical roles might include: @@ -182,7 +178,7 @@ Typical roles might include: ### Secrets A secret represents a single credential or other sensitive string of characters which must be stored securely. Each -secret is assigned to a device within NetBox. The plaintext value of a secret is encrypted to a ciphertext +secret __must be__ assigned to a `device` within `NetBox`. The plaintext value of a secret is encrypted to a ciphertext immediately prior to storage within the database using a 256-bit AES master key. A SHA256 hash of the plaintext is also stored along with each ciphertext to validate the decrypted plaintext. @@ -197,7 +193,7 @@ steps are needed to encrypt or decrypt secret data. In order to encrypt or decrypt secret data, a session key must be attached to the API request. To generate a session key, send an authenticated request to the `/api/plugins/secrets/session-keys/` endpoint with the private RSA key which -matches your [UserKey](../models/userkey.md). Place the private RSA key in a json file. +matches your [UserKey](#user-keys). Place the private RSA key in a json file. ```no-highlight $ curl -X POST http://netbox/api/plugins/secrets/session-keys/ \ @@ -257,7 +253,7 @@ curl -X POST https://netbox-test.tugraz.at/api/plugins/secrets/get-session-key/ ### Retrieving Secrets A session key is not needed to retrieve unencrypted secrets: The secret is returned like any normal object with its -`plaintext` field set to null. +`plaintext` field set to `null`. ```no-highlight $ curl http://netbox/api/plugins/secrets/secrets/2587/ \ @@ -435,11 +431,11 @@ $ curl -X POST http://netbox/api/secrets/secrets/ \ ## Pynetbox -The `pynetbox` library can be used to interact with the NetBox API as well. Here are some examples of how to use `pynetbox` to interact with the NetBox Secrets plugin. +The `pynetbox` Python lib can be used to interact with the NetBox API as well. Here are some examples of how to use `pynetbox` to interact with the NetBox Secrets plugin. For more information on `pynetbox`, please refer to the [pynetbox documentation](https://pynetbox.readthedocs.io/en/latest/). -### Generating RSA Key Pair +### Generating RSA Key Pair using Pynetbox You can use the `/api/plugins/secrets/generate-rsa-key-pair/` endpoint to generate a new RSA key pair. The keys are returned in PEM format. @@ -462,7 +458,7 @@ key_pair = nb.plugins.secrets.generate_rsa_key_pair.create() The `key_pair` variable will contain the public and private keys in PEM format. -### Activating User Key +### Activating User Key using Pynetbox To activate a user key, you can use the `/api/plugins/secrets/activate-user-key/` endpoint. The endpoint requires the private key in PEM format. @@ -484,7 +480,7 @@ nb.plugins.secrets.activate_user_key.create(private_key="") The user key will be activated and can now be used to encrypt and decrypt secrets. -### Generating Session Key +### Generating Session Key using Pynetbox To generate a session key, you can use the `/api/plugins/secrets/session-keys/` endpoint. The endpoint requires the private key in PEM format. @@ -506,7 +502,7 @@ session_key = nb.plugins.secrets.session_keys.create(private_key="" The `session_key` variable will contain the session key. The session key can now be used to encrypt and decrypt secrets. -### Creating Secrets +### Creating Secrets using Pynetbox To create a secret, you can use the `/api/plugins/secrets/secrets/` endpoint. The endpoint requires the session key in the `X-Session-Key` header. The data sent needs to be in the following format: @@ -514,26 +510,9 @@ To create a secret, you can use the `/api/plugins/secrets/secrets/` { "assigned_object_type": "string", "assigned_object_id": 2147483647, - "role": { - "name": "string", - "slug": "8M0SQnM8j0Y3Bto4c7SEs3w_2bvxF1SK9UFFRVSUfzW5CdD12Ro3o-ecA7yJP3OkHgvSy1zlsV84DgKNh2J02-578Q4Tvg0KsOe" - }, + "role": 1, // Role ID "name": "string", "plaintext": "string", - "description": "string", - "comments": "string", - "tags": [ - { - "name": "string", - "slug": "3iRRVSvfqln", - "color": "392511" - } - ], - "custom_fields": { - "additionalProp1": "string", - "additionalProp2": "string", - "additionalProp3": "string" - } } ``` @@ -558,26 +537,9 @@ nb.http_session = session secret = { "assigned_object_type": "dcim.device", "assigned_object_id": 2147483647, - "role": { - "name": "Login Credentials", - "slug": "login-creds" - }, + "role": 1, "name": "admin", "plaintext": "foobar", - "description": "Secret description", - "comments": "Secret comments", - "tags": [ - { - "name": "tag1", - "slug": "tag1", - "color": "392511" - } - ], - "custom_fields": { - "additionalProp1": "string", - "additionalProp2": "string", - "additionalProp3": "string" - } } nb.plugins.secrets.secrets.create(data=secret, session=session) @@ -585,7 +547,7 @@ nb.plugins.secrets.secrets.create(data=secret, session=session) The secret will be created and stored in the database. -### Retrieving Secrets +### Retrieving Secrets using Pynetbox To retrieve a secret, you can use the `/api/plugins/secrets/secrets/` endpoint. The endpoint requires the session key in the `X-Session-Key` header. The request response will be in the following format: @@ -661,7 +623,7 @@ secrets = nb.plugins.secrets.secrets.all(session=session) The `secrets` variable will contain a list of secrets. -### Updating Secrets +### Updating Secrets using Pynetbox To update a secret, you can use the `/api/plugins/secrets/secrets//` endpoint where the `` is the . The endpoint requires the session key in the `X-Session-Key` header. The data sent needs to be in the following format: @@ -715,26 +677,9 @@ nb.http_session = session secret = { "assigned_object_type": "dcim.device", "assigned_object_id": 2147483647, - "role": { - "name": "Login Credentials", - "slug": "login-creds" - }, + "role": 1, "name": "admin", "plaintext": "foobar", - "description": "Secret description", - "comments": "Secret comments", - "tags": [ - { - "name": "tag1", - "slug": "tag1", - "color": "392511" - } - ], - "custom_fields": { - "additionalProp1": "string", - "additionalProp2": "string", - "additionalProp3": "string" - } } nb.plugins.secrets.secrets.update(id=1, data=secret, session=session) From c39b8b4f96972f7bad4bc98a600c64025a540374 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vin=C3=ADcius=20Fontoura?= Date: Wed, 18 Dec 2024 11:17:22 -0300 Subject: [PATCH 8/9] [fix] removed redundancy --- README.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/README.md b/README.md index 3366f3a..7de8ab3 100644 --- a/README.md +++ b/README.md @@ -118,9 +118,7 @@ __Note: These options should be set in the NetBox configuration file, not in the ### User Keys -Each user within NetBox can associate their account with an RSA public key. If activated by an administrator, this user key will contain a unique, encrypted, copy of the AES master key needed to retrieve secret data. Have in mind that the key activation by an administrator is a __one-time operation__. - -User keys may be created by users individually, however they are of no use until they have been activated by a user who already possesses an active user key. +Each user within NetBox can associate their account with an RSA public key. After activated by an administrator, this user key will contain a unique, encrypted, copy of the AES master key needed to retrieve secret data. Have in mind that the key activation by an administrator is a __one-time operation__. #### Supported Key Format From e45883e47d706145eddc5e39a031e6bcb195d82c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vin=C3=ADcius=20Fontoura?= Date: Wed, 18 Dec 2024 11:23:32 -0300 Subject: [PATCH 9/9] [fix] highlighting netbox sidebar path with backticks --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 7de8ab3..b61eae8 100644 --- a/README.md +++ b/README.md @@ -157,7 +157,7 @@ to encrypt and decrypt secrets. Any user can create their user key by generating or uploading a public RSA key. However, a user key cannot be used to encrypt or decrypt secrets until it has been activated with an encrypted copy of the master key. -Only an administrator with an __active user key__ can activate other user keys. To do so, navigate to Plugins > Secrets > User Keys. Select the user key(s) to be activated, and select +Only an administrator with an __active user key__ can activate other user keys. To do so, navigate to `Plugins > Secrets > User Keys`. Select the user key(s) to be activated, and select `activate selected user keys` at the top right corner. You will need to provide your private key in order to decrypt the master key. A copy of the master key is then encrypted using the public key associated with the user key being activated and associated with the selected key(s).