1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
|
class FortiOS < Oxidized::Model
comment '# '
prompt /^([-\w.~]+(\s[(\w\-.)]+)?~?\s?[#>$]\s?)$/
expect /^--More--\s$/ do |data, re|
send ' '
data.sub re, ''
end
cmd :all do |cfg, cmdstring|
new_cfg = comment "COMMAND: #{cmdstring}\n"
new_cfg << cfg.each_line.to_a[1..-2].map { |line| line.gsub(/(conf_file_ver=)(.*)/, '\1<stripped>\3') }.join
end
cmd :secret do |cfg|
# ENC indicates an encrypted password, and secret indicates a secret string
cfg.gsub! /(set .+ ENC) .+/, '\\1 <configuration removed>'
cfg.gsub! /(set .*secret) .+/, '\\1 <configuration removed>'
# A number of other statements also contains sensitive strings
cfg.gsub! /(set (?:passwd|password|key|group-password|auth-password-l1|auth-password-l2|rsso|history0|history1)) .+/, '\\1 <configuration removed>'
cfg.gsub! /(set md5-key [0-9]+) .+/, '\\1 <configuration removed>'
cfg.gsub! /(set private-key ).*?-+END (ENCRYPTED|RSA) PRIVATE KEY-*"$/m, '\\1<configuration removed>'
cfg.gsub! /(set ca ).*?-+END CERTIFICATE-*"$/m, '\\1<configuration removed>'
cfg.gsub! /(set csr ).*?-+END CERTIFICATE REQUEST-*"$/m, '\\1<configuration removed>'
cfg.gsub! /(Cluster uptime:).*/, '\\1 <stripped>'
cfg
end
cmd 'get system status' do |cfg|
@vdom_enabled = cfg.include? 'Virtual domain configuration: enable'
cfg.gsub!(/(System time: )(.*)/, '\1<stripped>\3')
cfg.gsub! /(Virus-DB|Extended DB|IPS-DB|IPS-ETDB|APP-DB|INDUSTRIAL-DB|Botnet DB|IPS Malicious URL Database).*/, '\\1 <db version stripped>'
comment cfg
end
post do
cfg = []
cfg << cmd('config global') if @vdom_enabled
cfg << cmd('get hardware status') do |cfg|
comment cfg
end
# default behaviour: include autoupdate output (backwards compatibility)
# do not include if variable "show_autoupdate" is set to false
if defined?(vars(:fortios_autoupdate)).nil? || vars(:fortios_autoupdate)
cfg << cmd('diagnose autoupdate version') do |cfg|
cfg.gsub! /(FDS Address\n---------\n).*/, '\\1IP Address removed'
comment cfg.each_line.reject { |line| line.match /Last Update|Result/ }.join
end
end
cfg << cmd('end') if @vdom_enabled
cfg << cmd('show full-configuration | grep .')
cfg.join "\n"
end
cfg :telnet do
username /login:/
password /^Password:/
end
cfg :telnet, :ssh do
pre_logout "exit\n"
end
end
|
