.yml file: PA device password in clear text

[blebail]

Hi Luigi,

.yml file for DagPush node in /opt/minemeld/local/config shows password of the device in clear text. It should be at least hashed.

Thanks

Regards,

Bertrand

[lmori · Accepted solution]

Hi Bertrand,

the password can't be hashed because the authentication to PAN-OS API requires a plain text password (over an encrypted channel). An improvement could be encrypting passwords with a configurable secret key, but if you have the rights to access the VM and read the config files it wouldn't add a lot in terms of security.

Best thing is creating a PAN-OS account with limited rights dedicated to the minemeld.

Thanks,

luigi