Discussion:
[rancid] set password ENC
Gerhard Mourani
2016-03-11 15:30:37 UTC
Permalink
Hello List,

I’m still having problem with diff related to "set password ENC” that come again and again.
Fortigate version is v5.2.6,build711.
Rancid version is 3.2

Here an example of the line I would like to remove:

set password ENC AGPgQlrTRxOmZuUjKSSGaBqav+OG08kYtIUGTrVg7YNWv8Kz96DI/02XCUISGqEOncyp4mWxfx5AfZO9RZ2Xi+EJO00sJGlgJaeYZ47l2CDXISwum0INicQ2AETplkrzPglVsd78zWlogFtf4AQXxMbrYU+wCaTElsvc2G0eqftKCjOLEhl3vsSBmEPODPNKyjycXg==

Gerhard,
heasley
2016-03-15 17:26:25 UTC
Permalink
Post by Gerhard Mourani
Hello List,
I’m still having problem with diff related to "set password ENC” that come again and again.
meaning that the password has not changed but the encrypted string
changes repeatedly? The code only filters this line if FILTER_PWDS is
set to YES or ALL.
Post by Gerhard Mourani
Fortigate version is v5.2.6,build711.
Rancid version is 3.2
set password ENC AGPgQlrTRxOmZuUjKSSGaBqav+OG08kYtIUGTrVg7YNWv8Kz96DI/02XCUISGqEOncyp4mWxfx5AfZO9RZ2Xi+EJO00sJGlgJaeYZ47l2CDXISwum0INicQ2AETplkrzPglVsd78zWlogFtf4AQXxMbrYU+wCaTElsvc2G0eqftKCjOLEhl3vsSBmEPODPNKyjycXg==
Nick Hilliard
2016-03-15 17:35:10 UTC
Permalink
Post by heasley
meaning that the password has not changed but the encrypted string
changes repeatedly?
yeah, fortios does this. So does Adtran AOS. Apparently this is a
"feature".

Nick
heasley
2016-03-15 17:47:18 UTC
Permalink
Post by Nick Hilliard
Post by heasley
meaning that the password has not changed but the encrypted string
changes repeatedly?
yeah, fortios does this. So does Adtran AOS. Apparently this is a
"feature".
Nick
now i realize that someone wanted those saved, regardless of the cycling.
i suppose rancid does need an option separate from FILTER_PWDS to save
cycling passwords, as someone ask about last week.
Gerhard Mourani
2016-03-15 18:23:12 UTC
Permalink
Setting FILTER_PWDS to YES or NO, doesn’t make any difference.
Post by heasley
Post by Nick Hilliard
Post by heasley
meaning that the password has not changed but the encrypted string
changes repeatedly?
yeah, fortios does this. So does Adtran AOS. Apparently this is a
"feature".
Nick
now i realize that someone wanted those saved, regardless of the cycling.
i suppose rancid does need an option separate from FILTER_PWDS to save
cycling passwords, as someone ask about last week.
Gerhard Mourani
2016-03-18 22:44:48 UTC
Permalink
Guys,

This patch make the ENCRYPTED PRIVATE KEY part to be removed.

diff -ur rancid-3.2.orig/bin/fnrancid.in rancid-3.2/bin/fnrancid.in
--- rancid-3.2.orig/bin/fnrancid.in 2015-03-16 15:02:52.000000000 -0400
+++ rancid-3.2/bin/fnrancid.in 2016-03-17 13:22:16.494902363 -0400
@@ -170,6 +170,7 @@
sub GetSystem {
print STDERR " In GetSystem: $_" if ($debug);

+ my $priv_key;
while (<INPUT>) {
tr/\015//d;
next if /^\s*$/;
@@ -204,6 +205,11 @@
tr/\015//d;
next if /^\s*$/;
last if (/$prompt/);
+ # spot the start of an ENCRYPTED private key
+ $priv_key = 1 if(/^\s*set private-key "-----BEGIN ENCRYPTED PRIVATE KEY-----/);
+ # spot the end of an RSA private key
+ $priv_key = 0 && next if(/^\s*-----END ENCRYPTED PRIVATE KEY-----"/);
+ next if($priv_key == 1);

# System time is fortigate extraction time
next if (/^\s*!System time:/);

Gerhard,
Post by heasley
Post by Nick Hilliard
Post by heasley
meaning that the password has not changed but the encrypted string
changes repeatedly?
yeah, fortios does this. So does Adtran AOS. Apparently this is a
"feature".
Nick
now i realize that someone wanted those saved, regardless of the cycling.
i suppose rancid does need an option separate from FILTER_PWDS to save
cycling passwords, as someone ask about last week.
Gerhard Mourani
2016-03-15 17:40:07 UTC
Permalink
meaning that the password has not changed but the encrypted string changes repeatedly?
Yes, look like that. Password has no been changed.
Did you have a code I can add/change to eliminate all “set password ENC” parts?

Gerhard,
Post by Gerhard Mourani
Hello List,
I’m still having problem with diff related to "set password ENC” that come again and again.
meaning that the password has not changed but the encrypted string
changes repeatedly? The code only filters this line if FILTER_PWDS is
set to YES or ALL.
Post by Gerhard Mourani
Fortigate version is v5.2.6,build711.
Rancid version is 3.2
set password ENC AGPgQlrTRxOmZuUjKSSGaBqav+OG08kYtIUGTrVg7YNWv8Kz96DI/02XCUISGqEOncyp4mWxfx5AfZO9RZ2Xi+EJO00sJGlgJaeYZ47l2CDXISwum0INicQ2AETplkrzPglVsd78zWlogFtf4AQXxMbrYU+wCaTElsvc2G0eqftKCjOLEhl3vsSBmEPODPNKyjycXg==
Loading...