Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Obfuscate TACACS key in show run all and show tacacs #400

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

taoyl-ms
Copy link
Contributor

@taoyl-ms taoyl-ms commented Dec 5, 2018

- What I did
Obfuscate TACACS passkey in show run all and show tacacs output.
Please note that in DB the passkey is still in clear text.

- Previous command output (if the output of a command-line utility has changed)

admin@sonic:~$ show tacacs
TACPLUS global auth_type login
TACPLUS global timeout 5 (default)
TACPLUS global passkey mypasskey

TACPLUS_SERVER address 10.0.0.1
               priority 1
               tcp_port 49

TACPLUS_SERVER address 10.0.0.2
               priority 1
               tcp_port 49

- New command output (if the output of a command-line utility has changed)

admin@sonic:~$ show tacacs
TACPLUS global auth_type login
TACPLUS global timeout 5 (default)
TACPLUS global passkey my******

TACPLUS_SERVER address 10.0.0.1
               priority 1
               tcp_port 49

TACPLUS_SERVER address 10.0.0.2
               priority 1
               tcp_port 49

-->

@taoyl-ms taoyl-ms requested a review from lguohan December 5, 2018 00:59
@nikos-github
Copy link
Contributor

nikos-github commented Dec 5, 2018

Have you looked at a way to not have a cleartext key in the db? redis-cli is not privileged. It can be run by anyone by default. This is a security issue. One-way hash for example can be used.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants