.yml file: PA device password in clear text

Retired Member — Fri, 26 Feb 2016 11:18:06 GMT

Hi Luigi,

.yml file for DagPush node in /opt/minemeld/local/config shows password of the device in clear text. It should be at least hashed.

Thanks

Regards,

Bertrand

Re: .yml file: PA device password in clear text

lmori — Fri, 26 Feb 2016 11:25:13 GMT

Hi Bertrand,

the password can't be hashed because the authentication to PAN-OS API requires a plain text password (over an encrypted channel). An improvement could be encrypting passwords with a configurable secret key, but if you have the rights to access the VM and read the config files it wouldn't add a lot in terms of security.

Best thing is creating a PAN-OS account with limited rights dedicated to the minemeld.

Thanks,

luigi

topic Re: .yml file: PA device password in clear text in General Topics

.yml file: PA device password in clear text

Re: .yml file: PA device password in clear text