FortiOS changes private key encryption every time config is downloaded

[gbeekmans]

A feature of FortiOS is that it is designed to re-encrypt Private Key passwords which uses an initialization vector that contains random data. Each time the config is backed up or displayed, a different string is used to in order to enhance security.

The net effect is that every time Oxidized logs into a Fortigate (presumably other devices by Fortinet as well but Fortigate is the only one I use), it detects config changes. I can't run Oxidized as a daemon including all our Fortigates as it constantly sees changes. My only recourse so far is to run Oxidized manually once in a while to capture any changes that may have been applied.

I contacted tech support and they advised me that there is no way to turn this behaviour off aside from removing passwords from private keys which is not an option for us.

This unfortunately would need to be handled client-side in Oxidized itself. It would be okay if it ignored private key changes by way of a configuration option (I'd take on the responsibility myself to ensure I have recent backups or private keys if they need to be restored).

In essence a starting point would be to ignore any text between these markers:

set private-key "-----BEGIN ENCRYPTED PRIVATE KEY-----

-----END ENCRYPTED PRIVATE KEY-----"

"set private-key" is space intended so a regex like .*set private-key would work.

Could this be easily implemented by way of an updated fortios.rb model? I have been unsuccessful at figuring out how to do multi-line match & ignore like this.

Thanks,
Gerard Beekmans

[gbeekmans]

I just noticed this section in the fortios.rb file:

  cmd :secret do |cfg|
    cfg.gsub! /(set (?:passwd|password|psksecret)).*/, '\\1 <configuration removed>'
    cfg.gsub! /(set private-key).*-+END ENCRYPTED PRIVATE KEY-*"$/m , '\\1 <configuration removed>'
    cfg
  end

I believe it's already supposed to strip out encrypted private keys but it's obviously not doing that.

Could it be due to the fact "set private-key" is preceeded by white space, or is it because :secret has a special meaning that needs to be turned on as a variable? I see this :secret in many files but I can't find in the documentation how it's to be used.

[ytti]

Yes it can be easily done. It's more of a ruby question than Oxidized question. You could do something like.

cmd 'something' do |cfg|
  out = ""
  skip_line = false
  cfg.lines.each do |line|
    skip_line = true if line.match /BEGIN ENCRYPTED PRIVATE KEY/
    skip_line = false if line.match /END ENCRYPTED PRIVATE KEY/
    (out << line) unless skip_line
  end
  out
end

Or bazillion other ways to do it.

[gbeekmans]

Thanks, ytti. I will try that. I just found an answer to the ":secret" question by setting the remove_secret variable but I am finding it removes too many secrets. I want to keep most of them so I will try your Ruby method above and build on that.

[gbeekmans]

I think I have a working rewritten fortios.rb model now. Attached is a diff against the original one in case you want to take these changes and incorporate them.

fortios.rb.zip

[danilopopeye]

Attached is a diff against the original one in case you want to take these changes and incorporate them.

@gbeekmans could you open a pull request with your diffs?

I think I have a working rewritten fortios.rb model now.

since your problem seems to be resolved, can you close this issue?

[sfini]

I have removed the private keys with this

  cmd :secret do |cfg|
#    cfg.gsub! /(set (?:passwd|password|psksecret|secret|key|group-password|secondary-secret|tertiary-secret ENC)).*/, '\\1 <configuration removed>'
    cfg.gsub! /(ENC ).*/, '\\1 <configuration removed>'
    cfg.gsub! /(set private-key).*-+END ENCRYPTED PRIVATE KEY-*"$/m , '\\1 <configuration removed>'
    cfg.gsub! /(set ca ).*-+END CERTIFICATE-*"$/m , '\\1 <configuration removed>'
    cfg.gsub! /(set csr ).*-+END CERTIFICATE REQUEST-*"$/m , '\\1 <configuration removed>'
    cfg
  end

[laf]

@gbeekmans / @sfini can one of you submit a pull request with the fix?

[sfini]

@laf
Sure

[laf]

Fix merged in.

[nvmike]

I am using #1047 and on every run I have notification of changed key.
Forti with vdom
my global conf for the model is :
model: fortios
interval: 21600
use_syslog: false
debug: true
remove_secret: true
threads: 30
timeout: 120
retries: 3

I am getting lost with this

[sfini]

@nvmike
This issue is closed..

Please open a new issue , and write which key is change every time ( there are a lot )

Simone

[nvmike]

Done 1199# On 26 Feb 2018, at 18:42, sfini <notifications@github.com> wrote: @nvmike <https://github.com/nvmike> This issue is closed.. Please open a new issue , and write which key is change every time ( there are a lot ) Simone — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#931 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ASiVXlBr_uJex1WsYREIl4Qa-NE2nfexks5tYt8MgaJpZM4OS-kM>.

[nvmike]

@sfini - Thank you - I did open #1199
Mike

[anubisg1]

This issue still persists with version 0.30.1