Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[TACACS] Encrypt TACACS secret key with predefined shared key. #127

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[TACACS] Encrypt TACACS secret key with predefined shared key. #127

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions scripts/hostcfgd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,7 @@ LIMITS_CONF = "/etc/security/limits.conf"
TACPLUS_SERVER_PASSKEY_DEFAULT = ""
TACPLUS_SERVER_TIMEOUT_DEFAULT = "5"
TACPLUS_SERVER_AUTH_TYPE_DEFAULT = "pap"
TACPLUS_SECRET_PASSWORD = "ktbSJeed7apq9dZHOD1O5wW9cvSaRWjW767qLyFEurDTSNEvHdYspaCuEzZcMg8R"

# RADIUS
RADIUS_SERVER_AUTH_PORT_DEFAULT = "1812"
Expand Down Expand Up @@ -102,6 +103,15 @@ def signal_handler(sig, frame):
else:
syslog.syslog(syslog.LOG_INFO, "HostCfgd: invalid signal - ignoring..")

def decrypt_data(secret):
cmd = "echo " + format(secret) + " | openssl enc -aes-128-cbc -a -d -salt -pbkdf2 -pass pass:" + TACPLUS_SECRET_PASSWORD
proc = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE)
output, errs = proc.communicate()

if not errs:
output = output.decode('utf-8')

return output, errs

def run_cmd(cmd, log_err=True, raise_exception=False):
try:
Expand Down Expand Up @@ -1804,13 +1814,27 @@ class HostConfigDaemon:
syslog.syslog(syslog.LOG_INFO, 'SSH Update: key: {}, op: {}, data: {}'.format(key, op, data))

def tacacs_server_handler(self, key, op, data):
if 'passkey' in data:
passkey, errs = decrypt_data(data['passkey'])
if errs or len(passkey) == 0:
syslog.syslog(syslog.LOG_WARNING, "{}: decrypt_data failed.".format(key))
else:
data['passkey'] = passkey

self.aaacfg.tacacs_server_update(key, data)
log_data = copy.deepcopy(data)
if 'passkey' in log_data:
log_data['passkey'] = obfuscate(log_data['passkey'])
syslog.syslog(syslog.LOG_INFO, 'TACPLUS_SERVER update: key: {}, op: {}, data: {}'.format(key, op, log_data))

def tacacs_global_handler(self, key, op, data):
if 'passkey' in data:
passkey, errs = decrypt_data(data['passkey'])
if errs or len(passkey) == 0:
syslog.syslog(syslog.LOG_WARNING, "{}: decrypt_data failed.".format(key))
else:
data['passkey'] = passkey

self.aaacfg.tacacs_global_update(key, data)
log_data = copy.deepcopy(data)
if 'passkey' in log_data:
Expand Down
Loading