From 5c5a7244ed085235bddee0e34251dcc4537fd680 Mon Sep 17 00:00:00 2001
From: "David R. Bild" <david.bild@xaptum.com>
Date: Thu, 6 Apr 2017 18:23:32 -0500
Subject: Fixed IOS model to redact only secrets

The secrets configuration for IOS would the full contents of any line
containing a secret. Instead, just redact the secret, keeping the rest
of line instact for

"enable secret 5 SeCre7" was replaced by "<secret hidden>". Now it is
now replaced by "enable secret 5 <secret hidden>".
---
 lib/oxidized/model/ios.rb | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

(limited to 'lib/oxidized/model/ios.rb')

diff --git a/lib/oxidized/model/ios.rb b/lib/oxidized/model/ios.rb
index 0596f90..9fda128 100644
--- a/lib/oxidized/model/ios.rb
+++ b/lib/oxidized/model/ios.rb
@@ -26,14 +26,14 @@ class IOS < Oxidized::Model
 
   cmd :secret do |cfg|
     cfg.gsub! /^(snmp-server community).*/, '\\1 <configuration removed>'
-    cfg.gsub! /username (\S+) privilege (\d+) (\S+).*/, '<secret hidden>'
-    cfg.gsub! /^username \S+ password \d \S+/, '<secret hidden>'
-    cfg.gsub! /^username \S+ secret \d \S+/, '<secret hidden>'
-    cfg.gsub! /^enable (password|secret) \d \S+/, '<secret hidden>'
+    cfg.gsub! /^(username \S+ privilege \d+) (\S+).*/, '\\1 <secret hidden>'
+    cfg.gsub! /^(username \S+ password \d) (\S+)/, '\\1 <secret hidden>'
+    cfg.gsub! /^(username \S+ secret \d) (\S+)/, '\\1 <secret hidden>'
+    cfg.gsub! /^(enable (password|secret) \d) (\S+)/, '\\1 <secret hidden>'
     cfg.gsub! /^(\s+(?:password|secret)) (?:\d )?\S+/, '\\1 <secret hidden>'
-    cfg.gsub! /wpa-psk ascii \d \S+/, '<secret hidden>'
-    cfg.gsub! /key 7 \d.+/, '<secret hidden>'
-    cfg.gsub! /^tacacs-server key \d \S+/, '<secret hidden>'
+    cfg.gsub! /^(.*wpa-psk ascii \d) (\S+)/, '\\1 <secret hidden>'
+    cfg.gsub! /^(.*key 7) (\d.+)/, '\\1 <secret hidden>'
+    cfg.gsub! /^(tacacs-server key \d) (\S+)/, '\\1 <secret hidden>'
     cfg
   end
 
-- 
cgit v1.2.1


From a07b05d8685ba07380121e23757bb3631fffbe2a Mon Sep 17 00:00:00 2001
From: "David R. Bild" <david.bild@xaptum.com>
Date: Thu, 6 Apr 2017 18:27:45 -0500
Subject: Added IPSEC keys to IOS secrets config

---
 lib/oxidized/model/ios.rb | 1 +
 1 file changed, 1 insertion(+)

(limited to 'lib/oxidized/model/ios.rb')

diff --git a/lib/oxidized/model/ios.rb b/lib/oxidized/model/ios.rb
index 9fda128..c3d5543 100644
--- a/lib/oxidized/model/ios.rb
+++ b/lib/oxidized/model/ios.rb
@@ -34,6 +34,7 @@ class IOS < Oxidized::Model
     cfg.gsub! /^(.*wpa-psk ascii \d) (\S+)/, '\\1 <secret hidden>'
     cfg.gsub! /^(.*key 7) (\d.+)/, '\\1 <secret hidden>'
     cfg.gsub! /^(tacacs-server key \d) (\S+)/, '\\1 <secret hidden>'
+    cfg.gsub! /^(crypto isakmp key) (\S+) (.*)/, '\\1 <secret hidden> \\3'
     cfg
   end
 
-- 
cgit v1.2.1