How to decrypt remote-password from auth group

nisheeth — Tue, 11 Jun 2024 18:39:48 GMT

I have created the an auth group and thru api query I can retrieve the auth group int he code

/restconf/data/tailf-ncs:devices/authgroups/group=<group-name> or use maapi

Now i get the encrypted remote-password how do i decrypt the remote password for use

Nisheeth

Re: How to decrypt remote-password from auth group

Daniel Kratz — Tue, 11 Jun 2024 19:53:14 GMT

Hi @nisheeth ,
Thanks to NSO architecture, in most of the cases, you don't need to access the user credentials.
For exceptions, you need to use the maapi api to retrieve the nso cryptographic material, and then use nso low level decrypt procedure to have access to the clear password.

https://developer.cisco.com/docs/nso/api/_ncs-maapi/#header-functions
def install_crypto_keys(sock)

Copy configured DES3 and AES keys into the memory in the library.

Keyword arguments:

sock – a python socket instance

https://developer.cisco.com/docs/nso/api/_ncs/#header-functionsdef decrypt(ciphertext) ‑> str

When data is read over the CDB interface, the MAAPI interface or received in event notifications, the data for the builtin types tailf:des3-cbc-encrypted-string, tailf:aes-cfb-128-encrypted-string and tailf:aes-256-cfb-128-encrypted-string is encrypted. This function decrypts ciphertext and returns the clear text as a string.

Keyword arguments:

ciphertext – encrypted string

In the following document you can find a code example.
https://developer.cisco.com/docs/nso-guides-6.3/python-api-overview/#advanced-topics

Example 102. Setting of configuration data using MAAPI

import socket
import _ncs
from _ncs import maapi

sock_maapi = socket.socket()

maapi.connect(sock_maapi,
              ip='127.0.0.1',
              port=_ncs.NCS_PORT)

maapi.load_schemas(sock_maapi)

maapi.start_user_session(
                  sock_maapi,
                  'admin',
                  'python',
                  [],
                  '127.0.0.1',
                  _ncs.PROTO_TCP)

maapi.install_crypto_keys(sock_maapi)


th = maapi.start_trans(sock_maapi, _ncs.RUNNING, _ncs.READ)

path = "/devices/authgroups/group{default}/umap{admin}/remote-password"
encrypted_password = maapi.get_elem(sock_maapi, th, path)

decrypted_password = _ncs.decrypt(str(encrypted_password))

maapi.finish_trans(sock_maapi, th)
maapi.end_user_session(sock_maapi)
sock_maapi.close()

print("Default authgroup admin password = %s" % decrypted_password)

topic How to decrypt remote-password from auth group in NSO Developer Hub Discussions

How to decrypt remote-password from auth group

Re: How to decrypt remote-password from auth group