[YANG] Add support for Password Hardening #10322
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| { | ||
| "PASSWORD_TABLE": { | ||
| "desc": "Configure policer with all default fields." | ||
| }, | ||
| "PASSWORD_ENABLE_FEATURE_WITH_POLICIES": { | ||
| "desc": "Configure password policies and enabled feature." | ||
| }, | ||
| "PASSWORD_BAD_ENABLE_FEATURE": { | ||
| "desc": "Configure password policies enabled feature with a wrong value.", | ||
| "eStrKey" : "InvalidValue" | ||
| }, | ||
| "PASSWORD_BAD_DIGIT": { | ||
| "desc": "Configure password Digit Class policy with invalid value", | ||
| "eStrKey" : "InvalidValue" | ||
| }, | ||
| "PASSWORD_BAD_HISTORY_CNT": { | ||
| "desc": "Configure password history_cnt with out of range value", | ||
| "eStrKey" : "InvalidValue" | ||
| }, | ||
| "PASSWORD_BAD_LEN_MIN": { | ||
| "desc": "Configure password len-min with out of range value", | ||
| "eStrKey" : "Pattern" | ||
| }, | ||
| "PASSWORD_BAD_EXPIRATION": { | ||
| "desc": "Configure password expiration with out of range value", | ||
| "eStrKey" : "Pattern" | ||
| }, | ||
| "PASSWORD_BAD_EXPIRATION_WARN": { | ||
| "desc": "Configure password expiration-warning with out of range value", | ||
| "eStrKey" : "Pattern" | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,146 @@ | ||
| { | ||
| "PASSWORD_TABLE": { | ||
| "sonic-passwh:sonic-passwh": { | ||
| "sonic-passwh:PASSW_HARDENING": { | ||
| "POLICIES":{ | ||
| "state": "disabled", | ||
| "expiration": "180", | ||
| "expiration_warning": "15", | ||
| "history_cnt": "10", | ||
| "len_min": "8", | ||
| "reject_user_passw_match": true, | ||
| "lower_class": true, | ||
| "upper_class": true, | ||
| "digits_class": true, | ||
| "special_class": true | ||
| } | ||
| } | ||
| } | ||
| }, | ||
| "PASSWORD_ENABLE_FEATURE_WITH_POLICIES": { | ||
| "sonic-passwh:sonic-passwh": { | ||
| "sonic-passwh:PASSW_HARDENING": { | ||
| "POLICIES":{ | ||
| "state": "enabled", | ||
| "expiration": "180", | ||
| "expiration_warning": "15", | ||
| "history_cnt": "10", | ||
| "len_min": "8", | ||
| "reject_user_passw_match": true, | ||
| "lower_class": true, | ||
| "upper_class": true, | ||
| "digits_class": true, | ||
| "special_class": true | ||
| } | ||
| } | ||
| } | ||
| }, | ||
| "PASSWORD_BAD_ENABLE_FEATURE": { | ||
| "sonic-passwh:sonic-passwh": { | ||
| "sonic-passwh:PASSW_HARDENING": { | ||
| "POLICIES":{ | ||
| "state": "33", | ||
| "expiration": "180", | ||
| "expiration_warning": "15", | ||
| "history_cnt": "10", | ||
| "len_min": "8", | ||
| "reject_user_passw_match": true, | ||
| "lower_class": true, | ||
| "upper_class": true, | ||
| "digits_class": true, | ||
| "special_class": true | ||
| } | ||
| } | ||
| } | ||
| }, | ||
| "PASSWORD_BAD_DIGIT": { | ||
| "sonic-passwh:sonic-passwh": { | ||
| "sonic-passwh:PASSW_HARDENING": { | ||
| "POLICIES":{ | ||
| "state": "disabled", | ||
| "expiration": "180", | ||
| "expiration_warning": "15", | ||
| "history_cnt": "10", | ||
| "len_min": "8", | ||
| "reject_user_passw_match": true, | ||
| "lower_class": true, | ||
| "upper_class": true, | ||
| "digits_class": "1", | ||
| "special_class": true | ||
| } | ||
| } | ||
| } | ||
| }, | ||
| "PASSWORD_BAD_HISTORY_CNT": { | ||
| "sonic-passwh:sonic-passwh": { | ||
| "sonic-passwh:PASSW_HARDENING": { | ||
| "POLICIES":{ | ||
| "state": "enabled", | ||
| "expiration": "180", | ||
| "expiration_warning": "15", | ||
| "history_cnt": "300", | ||
| "len_min": "8", | ||
| "reject_user_passw_match": true, | ||
| "lower_class": true, | ||
| "upper_class": true, | ||
| "digits_class": true, | ||
| "special_class": true | ||
| } | ||
| } | ||
| } | ||
| }, | ||
| "PASSWORD_BAD_LEN_MIN": { | ||
| "sonic-passwh:sonic-passwh": { | ||
| "sonic-passwh:PASSW_HARDENING": { | ||
| "POLICIES":{ | ||
| "state": "enabled", | ||
| "expiration": "180", | ||
| "expiration_warning": "15", | ||
| "history_cnt": "50", | ||
| "len_min": "50", | ||
| "reject_user_passw_match": true, | ||
| "lower_class": true, | ||
| "upper_class": true, | ||
| "digits_class": true, | ||
| "special_class": true | ||
| } | ||
| } | ||
| } | ||
| }, | ||
| "PASSWORD_BAD_EXPIRATION": { | ||
| "sonic-passwh:sonic-passwh": { | ||
| "sonic-passwh:PASSW_HARDENING": { | ||
| "POLICIES":{ | ||
| "state": "enabled", | ||
| "expiration": "400", | ||
| "expiration_warning": "15", | ||
| "history_cnt": "50", | ||
| "len_min": "8", | ||
| "reject_user_passw_match": true, | ||
| "lower_class": true, | ||
| "upper_class": true, | ||
| "digits_class": true, | ||
| "special_class": true | ||
| } | ||
| } | ||
| } | ||
| }, | ||
| "PASSWORD_BAD_EXPIRATION_WARN": { | ||
| "sonic-passwh:sonic-passwh": { | ||
| "sonic-passwh:PASSW_HARDENING": { | ||
| "POLICIES":{ | ||
| "state": "enabled", | ||
| "expiration": "180", | ||
| "expiration_warning": "40", | ||
| "history_cnt": "10", | ||
| "len_min": "8", | ||
| "reject_user_passw_match": true, | ||
| "lower_class": true, | ||
| "upper_class": true, | ||
| "digits_class": true, | ||
| "special_class": true | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,75 @@ | ||
| module sonic-passwh { | ||
| yang-version 1.1; | ||
| namespace "http://github.com/Azure/sonic-passwh"; | ||
| prefix password; | ||
|
|
||
| description "PASSWORD HARDENING YANG Module for SONiC OS"; | ||
|
|
||
| revision 2021-10-12 { | ||
| description "First Revision"; | ||
| } | ||
|
|
||
| container sonic-passwh { | ||
|
|
||
| typedef feature_state { | ||
| type enumeration { | ||
| enum enabled; | ||
| enum disabled; | ||
| } | ||
| } | ||
|
|
||
| container PASSW_HARDENING { | ||
| description "PASSWORD HARDENING part of config_db.json"; | ||
| container POLICIES { | ||
| leaf state { | ||
|
There was a problem hiding this comment. The feature will set to disable by default, so maybe add default values to yang model? There was a problem hiding this comment. @dgsudharsan I removed the default because I understand from you that it is not necessary anymore, There was a problem hiding this comment. @liuh-80 In the yang subgroup meeting it is decided not to have default in yang model but rather handle it in application. The reason is having default will push it to config_db and currently there is no way to differentiate between user configuration from default configuration. There was a problem hiding this comment. Have the same concern. We should add default value (disable) into yang model. |
||
| description "state of the feature"; | ||
| type feature_state; | ||
| } | ||
| leaf expiration { | ||
| description "expiration time (days unit)"; | ||
| type uint16 { | ||
| range 1..365; | ||
| } | ||
| } | ||
| leaf expiration_warning { | ||
| description "expiration warning time (days unit)"; | ||
| type uint8 { | ||
| range 1..30; | ||
| } | ||
| } | ||
| leaf history_cnt { | ||
| description "num of old password that the system will recorded"; | ||
| type uint8 { | ||
| range 1..100; | ||
| } | ||
| } | ||
| leaf len_min { | ||
| description "password min length"; | ||
| type uint8 { | ||
| range 1..32; | ||
| } | ||
| } | ||
| leaf reject_user_passw_match{ | ||
| description "username password match"; | ||
| type boolean; | ||
| } | ||
| leaf lower_class{ | ||
| description "password lower chars policy"; | ||
| type boolean; | ||
| } | ||
| leaf upper_class{ | ||
| description "password upper chars policy"; | ||
| type boolean; | ||
| } | ||
| leaf digits_class{ | ||
| description "password digits chars policy"; | ||
| type boolean; | ||
| } | ||
| leaf special_class{ | ||
| description "password special chars policy"; | ||
| type boolean; | ||
| } | ||
| }/*container policies */ | ||
| } /* container PASSWH */ | ||
| }/* container sonic-passwh */ | ||
| }/* end of module sonic-passwh */ | ||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please fix the revision date
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done