12-12-2011 11:20 AM
Are they hashed before storing them in the config files? By the looks of them, it seems like the PAN appliance is storing them in an encrypted format. If so, can they be decrypted?
For example, an OSPF key is stored as follows
This pattern can be observed in almost all of the keys/passwords stored in the XML config. Is there a way to decrypt these keys. I am particularly interested in the OSPF MD5 keys as I need to add new routers to our network but I don't know the key.
Has anyone successfully decrypted a PAN key?
12-15-2011 10:57 AM
Yes the passwords are hashed on the config file.
I have not heard of any case where someone has every decrypted the password or keys.
Below is a password policy document that might assist with your question.
This option is available by enabling FIPS mode (FIPS 140-2) on the FW, though the following options will also apply:
Federal Information Processing Standards Support:
• To log into the firewall, the browser must be TLS 1.0 compatible.
• All passwords on the firewall must be at least six characters.
• Accounts are locked after the number of failed attempts that is configured on theDevice > Setup > Management page. If the firewall is not in FIPS mode, it can be configured so that it never locks out; however in FIPS mode, and lockout time is required.
• The firewall automatically determines the appropriate level of self-testing and enforces the appropriate level of strength in encryption algorithms and cipher suites.
• Non-FIPS approved algorithms are not decrypted and are thus ignored during decryption.
• When configuring IPSec, a subset of the normally available cipher suites is available.
• Self-generated and imported certificates must contain public keys that are 2048 bits (or more).
• The serial port is disabled.
• Telnet, TFTP, and HTTP management connections are unavailable.
• Surf control is not supported.
• High availability (HA) encryption is required.
• PAP authentication is disabled..
Below is a Knowledgepoint Article regarding FIPS Mode:
FIPS mode (enabling/details) can be referenced as well via your Admin Guide.
12-15-2011 11:02 AM
Hi. Thank you for your reply.
After going through the config files of different devices, I am pretty sure the passwords are not hashed but are encrypted.
What we see in the configuration files are definitely not hashes. So the PAN device must be doing something behind the scenes to decrypt these when using them. The question is what encryption/decryption scheme is being used in this case.
12-16-2011 02:31 AM
PAN documentation seems to be clear about it : XML config stored "encrypted" passwords and private keys:
Encrypting Private Keys and Passwords on the Firewall
*Device > Master Key and Diagnostics
Use the Master Key and Diagnostics page to specify a master key to encrypt private keys on the firewall. Private keys are stored in encrypted form by default even if a new master key is not specified.
Specify the key that is currently used to encrypt all of the private keys andpasswords on the firewall.
Specify the number of days and hours after which the master key expires.
Specify the number of days and hours before expiration when the user isnotified of the impending expiration.
In Common Criteria mode, additional buttons are available to run acryptographic algorithm self-test and software integrity self-test. A scheduler is also included to specify the times at which the two self-tests will run.
My understanding : PaloAlto is using some kind of secret passphrase that is used to encrypt passwords and private keys. If they are using right algorithms, it could be strong protection (AES-256 for example) as long as that passphrase doesn't get out of PA office or it's generated for each box out of factory. If you want extra security, go in Device -> Master Key and diagnostics and change the master key, but make sure you never loose that passphrase or you won't be able to restore from a cold backup.
When you create a case at PA support, you bring them your config XML or tech dump (which contains config). But they never ask you for a password to run their tests, 2 solutions : they change passwords in XML before importing, or they have default master key of all device they sell. I tend to believe second solution
12-16-2011 08:11 AM
Thank you. This is what I was looking for. Let me see if I can find out what encryption scheme is being used in this case.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!