How are passwords and keys stored in PAN xml config files

[rajqfs]

Are they hashed before storing them in the config files? By the looks of them, it seems like the PAN appliance is storing them in an encrypted format. If so, can they be decrypted?

For example, an OSPF key is stored as follows

"-AQ==xxxxxxxxxxxxx=xxxxxxxxxxxxx=="

This pattern can be observed in almost all of the keys/passwords stored in the XML config. Is there a way to decrypt these keys. I am particularly interested in the OSPF MD5 keys as I need to add new routers to our network but I don't know the key.

Has anyone successfully decrypted a PAN key?

Thanks.

[essnet]

Do you remove private keys also ? I have many private keys here for SSL decryption and VPN.

[holmesw]

Yes, we have removed the public and private keys.  These seem to be at the beginning of the XML configuration file and can be manually removed.

[essnet]

After some investigations, the techdump.tgz file seems to be cleaned of its passwords and private keys, so techdumps are not a threat. Just be careful when you export the config.xml , this one has them all.

[SRA]

Hashed password. You can use openssl passwd to compute the md5 phash.

[rgraves]

Yes, administrator passwords for login to the firewall are hashed (looks like standard Linux/FreeBSD salted MD5), but what about passwords used externally? For example, the bind-password for LDAP or ActiveDirectory service accounts. Mine starts with <bind-password>-AQ==

[ksteves1]

you can also use the 'request password-hash' operational mode CLI command.

[Bart_Jocque]

I also noticed that when I create users via the API in 4.1, I can send the passwords in clear.

[IkramBaharum]

guys,

Is this still the case for 5.0.X PAs ?

[mikand]

Given that PA recently got approved for various security oriented certificates I sure do hope this has been fixed or at least noted in these tests:

http://researchcenter.paloaltonetworks.com/2013/06/usgv6-for-ipv6-common-criteria-eal-4-and-certific...

http://researchcenter.paloaltonetworks.com/2013/07/update-on-certifications-dept-of-defense-uc-apl/