How to decrypt remote-password from auth group

[nisheeth]

Hi 

I have created the an auth group and thru api query I can retrieve the auth group int he code

/restconf/data/tailf-ncs:devices/authgroups/group=<group-name> or use maapi

Now i get the encrypted remote-password how do i decrypt the remote password for use

Nisheeth

[Daniel Kratz]

Hi @nisheeth ,
Thanks to NSO architecture, in most of the cases, you don't need to access the user credentials.
For exceptions, you need to use the maapi api to retrieve the nso cryptographic material, and then use nso low level decrypt procedure to have access to the clear password.

https://developer.cisco.com/docs/nso/api/_ncs-maapi/#header-functions
def install_crypto_keys(sock)

Copy configured DES3 and AES keys into the memory in the library.

Keyword arguments:

• sock – a python socket instance

https://developer.cisco.com/docs/nso/api/_ncs/#header-functions
def decrypt(ciphertext) ‑> str

When data is read over the CDB interface, the MAAPI interface or received in event notifications, the data for the builtin types tailf:des3-cbc-encrypted-string, tailf:aes-cfb-128-encrypted-string and tailf:aes-256-cfb-128-encrypted-string is encrypted. This function decrypts ciphertext and returns the clear text as a string.

Keyword arguments:

• ciphertext – encrypted string

 

In the following document you can find a code example.
https://developer.cisco.com/docs/nso-guides-6.3/python-api-overview/#advanced-topics

Example 102. Setting of configuration data using MAAPI

import socket
import _ncs
from _ncs import maapi

sock_maapi = socket.socket()

maapi.connect(sock_maapi,
              ip='127.0.0.1',
              port=_ncs.NCS_PORT)

maapi.load_schemas(sock_maapi)

maapi.start_user_session(
                  sock_maapi,
                  'admin',
                  'python',
                  [],
                  '127.0.0.1',
                  _ncs.PROTO_TCP)

maapi.install_crypto_keys(sock_maapi)


th = maapi.start_trans(sock_maapi, _ncs.RUNNING, _ncs.READ)

path = "/devices/authgroups/group{default}/umap{admin}/remote-password"
encrypted_password = maapi.get_elem(sock_maapi, th, path)

decrypted_password = _ncs.decrypt(str(encrypted_password))

maapi.finish_trans(sock_maapi, th)
maapi.end_user_session(sock_maapi)
sock_maapi.close()

print("Default authgroup admin password = %s" % decrypted_password)