Are they hashed before storing them in the config files? By the looks of them, it seems like the PAN appliance is storing them in an encrypted format. If so, can they be decrypted?
For example, an OSPF key is stored as follows
This pattern can be observed in almost all of the keys/passwords stored in the XML config. Is there a way to decrypt these keys. I am particularly interested in the OSPF MD5 keys as I need to add new routers to our network but I don't know the key.
Has anyone successfully decrypted a PAN key?
Yes the passwords are hashed on the config file.
I have not heard of any case where someone has every decrypted the password or keys.
Below is a password policy document that might assist with your question.
This option is available by enabling FIPS mode (FIPS 140-2) on the FW, though the following options will also apply:
Federal Information Processing Standards Support:
• To log into the firewall, the browser must be TLS 1.0 compatible.
• All passwords on the firewall must be at least six characters.
• Accounts are locked after the number of failed attempts that is configured on theDevice > Setup > Management page. If the firewall is not in FIPS mode, it can be configured so that it never locks out; however in FIPS mode, and lockout time is required.
• The firewall automatically determines the appropriate level of self-testing and enforces the appropriate level of strength in encryption algorithms and cipher suites.
• Non-FIPS approved algorithms are not decrypted and are thus ignored during decryption.
• When configuring IPSec, a subset of the normally available cipher suites is available.
• Self-generated and imported certificates must contain public keys that are 2048 bits (or more).
• The serial port is disabled.
• Telnet, TFTP, and HTTP management connections are unavailable.
• Surf control is not supported.
• High availability (HA) encryption is required.
• PAP authentication is disabled..
Below is a Knowledgepoint Article regarding FIPS Mode:
FIPS mode (enabling/details) can be referenced as well via your Admin Guide.
Hi. Thank you for your reply.
After going through the config files of different devices, I am pretty sure the passwords are not hashed but are encrypted.
What we see in the configuration files are definitely not hashes. So the PAN device must be doing something behind the scenes to decrypt these when using them. The question is what encryption/decryption scheme is being used in this case.
PAN documentation seems to be clear about it : XML config stored "encrypted" passwords and private keys:
Use the Master Key and Diagnostics page to specify a master key to encrypt private keys on the firewall. Private keys are stored in encrypted form by default even if a new master key is not specified.
My understanding : PaloAlto is using some kind of secret passphrase that is used to encrypt passwords and private keys. If they are using right algorithms, it could be strong protection (AES-256 for example) as long as that passphrase doesn't get out of PA office or it's generated for each box out of factory. If you want extra security, go in Device -> Master Key and diagnostics and change the master key, but make sure you never loose that passphrase or you won't be able to restore from a cold backup.
When you create a case at PA support, you bring them your config XML or tech dump (which contains config). But they never ask you for a password to run their tests, 2 solutions : they change passwords in XML before importing, or they have default master key of all device they sell. I tend to believe second solution :smileyhappy:
I would like it to be documented as well because I found something that disturbs me :
PaloAlto support interface is based on cloud Salesforce.com solution and all attachments to cases (config file and tech dumps for example) are stored on Amazon S3.
It means that beside PaloAlto, SalesForce and Amazon employees may also have access to my configuration files which include some passwords and private keys (in addition of my filtering policies).
For sanitization, we use a sed script to remove the encryption strings and usernames from the XML configuration.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!