oxidized 0.24.0 → 0.25.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c00743626e287a15848821ba168ad2cbb824e5df3a325cbaa890b955ea3dafa1
-  data.tar.gz: e83a4ba0e11cf259ec0c81850812f736bbe519428d36297c6b8741e0a68e9036
+  metadata.gz: df89ebe44036e31f147e438859b3194499271aed11ba43ef571cfe3d200d2d3a
+  data.tar.gz: 9871fde749ce3fa2788f80522cdcf252af42202c00accade821fe6672343d8ef
 SHA512:
-  metadata.gz: f38ea9bb12acf38a4a4f5477c87c478f9f761497a9d138e776793cca9d64b25010ae319d3c580fcafea772c1f5dc14a2d34b4cbb5b2ecc8d7001b45df0d24089
-  data.tar.gz: 22393220362199339fbad22f7db8b2c4981e229a48a8d8762e7fe6e56bcb33e722664747b4600bc3c9185b1f367b40db803800efdd513c5f167a2e3c2afd92d3
+  metadata.gz: 422d2c2066fb23df08dd72e11a376f055c16831f79b942c74d59288bf944c7f143a108b0cc4d3a986c3f1893bf5b9a2a15892db03f762cb86e9692ecb4c22819
+  data.tar.gz: 5759e188494ea8fade09b907ceb8b0227a5992fa89753a7d840eece46c0d1a75a8f13c37aa2c15922a0fb0811bad2f430bd5f33c18db2b1d89149836fab58535

data/.codeclimate.yml

@@ -0,0 +1,4 @@
+---
+version: "2"
+exclude_patterns:
+  - lib/oxidized/output/gitcrypt.rb

data/.rubocop.yml

@@ -33,6 +33,9 @@ Style/RescueModifier:
 Style/MultilineBlockChain:
   Enabled: false
 
+Style/SymbolProc:
+  Enabled: false
+
 # Do not attempt to police vendored code, and exclude special cases
 AllCops:
   Exclude:

data/CHANGELOG.md

@@ -1,6 +1,31 @@
 # Changelog
 
-## 024.0
+## Master
+
+* FEATURE: add viptela model (@bobthebutcher)
+* FEATURE: add ECI Telecom Appolo platform bij arien.vijn@linklight.nl
+* FEATURE: ssh keepalive now configurable per node with ssh_no_keepalive boolean
+* FEATURE: add Comtrol model (@RobbFromIT)
+* FEATURE: add Dell X-series model (@RobbFromIT)
+* FEATURE: add privilege escalation to the cumulus model (@user4574)
+* FEATURE: add adtran model (@CFUJoshWeepie)
+* FEATURE: add firebrick model (@lewisvive)
+* BUGFIX: netgear telnet password prompt not detected
+* BUGFIX: xos model should not modify config on legacy Extreme Networks devices (@sq9mev)
+* BUGFIX: model dlink, edgecos, ciscosmb, openbsd
+* BUGFIX: hide 'lighttpd_ls_password' as potential secret in pfsense model (@dra)
+* BUGFIX: ciscospark hook error when diff is set to false
+* MISC: bump Dockerfile phusion/baseimage:0.10.0 -> 0.11, revert to one-stage build
+* MISC: add sqlite3 and mysql2 drivers for sequel to Dockerfile
+* MISC: Added verbiage to set OXIDIZED_HOME correctly under Debian 8.8 w/systemd
+* MISC: add gpgme and sequel gems to Dockerfile for sources
+* MISC: eos model removes user secrets and BGP secrets (@yzguy)
+* MISC: add secret filtering to netscaler (@shepherdjay)
+* MISC: capture ZebOS configuration for TMOS model (@yzguy)
+* MISC: additional secret filters in ios, asa, procurve, ciscosmb models (@hexdump0x0200)
+* MISC: remove volatile uptime data in nos model (@f0rkz)
+
+## 0.24.0
 
 * FEATURE: add frr support to cumulus model (@User4574 / @bobthebutcher)
 * FEATURE: honour MAX_STAT in mtime, to store last N mtime
@@ -8,7 +33,6 @@
 * FEATURE: model callback enhancements for customizing existing models (@ytti)
 * BUGFIX: models ciscosmb, dlink
 
-
 ## 0.23.0
 
 * FEATURE: support arbitrary user/password/prompt detection in telnet, same behaviour as ssh

data/Dockerfile

@@ -1,39 +1,16 @@
-# -- stage 1: backport libssh2 1.7.0 from zesty for xenial, as githubrepo hook requires it
-FROM ubuntu:xenial as libssh2-backport
-
-# set up dependencies for the build process
-RUN apt-get -yq update && \
-    apt-get -yq install build-essential chrpath debhelper dh-autoreconf libgcrypt20-dev zlib1g-dev
-
-# build libssh2 1.7.0
-WORKDIR /tmp/libssh2-build
-ADD https://launchpad.net/ubuntu/+archive/primary/+files/libssh2_1.7.0-1ubuntu1.debian.tar.xz .
-ADD https://launchpad.net/ubuntu/+archive/primary/+files/libssh2_1.7.0.orig.tar.gz .
-RUN tar xvf libssh2_1.7.0.orig.tar.gz
-WORKDIR /tmp/libssh2-build/libssh2-1.7.0
-RUN tar xvf ../libssh2_1.7.0-1ubuntu1.debian.tar.xz
-
-WORKDIR /tmp/libssh2-build/libssh2-1.7.0
-ENV DEB_BUILD_OPTIONS nocheck
-RUN dpkg-buildpackage -b
-
-# -- stage 2: build the actual oxidized container
-FROM phusion/baseimage:0.10.0
+# Single-stage build of an oxidized container from phusion/baseimage-docker v0.11, derived from Ubuntu 18.04 (Bionic Beaver)
+FROM phusion/baseimage:0.11
 LABEL maintainer="Samer Abdel-Hafez <sam@arahant.net>"
 
 # set up dependencies for the build process
 RUN apt-get -yq update && \
-    apt-get -yq install ruby2.3 ruby2.3-dev libsqlite3-dev libssl-dev pkg-config make cmake libssh2-1-dev git g++ libffi-dev ruby-bundler libicu-dev
-
-# upgrade libssh2 to self-built backport from stage 1
-COPY --from=libssh2-backport \
-    /tmp/libssh2-build/libssh2-1_1.7.0-1ubuntu1_amd64.deb \
-    /tmp/libssh2-build/libssh2-1-dev_1.7.0-1ubuntu1_amd64.deb \
-    /tmp/
-RUN dpkg -i /tmp/*.deb
+    apt-get -yq install ruby2.5 ruby2.5-dev libssl1.1 libssl-dev pkg-config make cmake libssh2-1 libssh2-1-dev git g++ libffi-dev ruby-bundler libicu60 libicu-dev libsqlite3-0 libsqlite3-dev libmysqlclient20 libmysqlclient-dev
 
 # dependencies for hooks
-RUN gem install aws-sdk slack-api xmpp4r cisco_spark
+RUN gem install aws-sdk slack-api xmpp4r cisco_spark --no-ri --no-rdoc
+
+# dependencies for sources
+RUN gem install gpgme sequel sqlite3 mysql2 --no-ri --no-rdoc
 
 # build and install oxidized
 COPY . /tmp/oxidized/
@@ -49,8 +26,7 @@ RUN gem install oxidized-web --no-ri --no-rdoc
 # clean up
 WORKDIR /
 RUN rm -rf /tmp/oxidized
-RUN rm /tmp/*.deb
-RUN apt-get -yq --purge autoremove ruby-dev pkg-config make cmake ruby-bundler
+RUN apt-get -yq --purge autoremove ruby-dev pkg-config make cmake ruby-bundler libssl-dev libssh2-1-dev libicu-dev libsqlite3-dev libmysqlclient-dev
 
 # add runit services
 ADD extra/oxidized.runit /etc/service/oxidized/run

data/README.md

@@ -32,7 +32,7 @@ Check out the [Oxidized TREX 2014 presentation](http://youtu.be/kBQ_CTUuqeU#t=3h
 
 1. [Supported OS Types](docs/Supported-OS-Types.md)
 2. [Installation](#installation)
-    * [Debian](#debian)
+    * [Debian and Ubuntu](#debian-and-ubuntu)
     * [CentOS, Oracle Linux, Red Hat Linux](#centos-oracle-linux-red-hat-linux)
     * [FreeBSD](#freebsd)
     * [Build from Git](#build-from-git)
@@ -74,14 +74,26 @@ Check out the [Oxidized TREX 2014 presentation](http://youtu.be/kBQ_CTUuqeU#t=3h
 
 ## Installation
 
-### Debian
+### Debian and Ubuntu
 
-Install all required packages and gems.
+Debian "buster" or newer and Ubuntu 17.10 (artful) or newer are recommended. On Ubuntu, begin by enabling the `universe` 
+repository (required for libssh2-1-dev):
+
+```shell
+add-apt-repository universe
+```
+
+Install the dependencies:
 
 ```shell
 apt-get install ruby ruby-dev libsqlite3-dev libssl-dev pkg-config cmake libssh2-1-dev libicu-dev zlib1g-dev
+```
+
+Finally, install the gems:
+
+```shell
 gem install oxidized
-gem install oxidized-script oxidized-web # if you don't install oxidized-web, make sure you remove "rest" from your config
+gem install oxidized-script oxidized-web # If you don't install oxidized-web, ensure "rest" is removed from your Oxidized config.
 ```
 
 ### CentOS, Oracle Linux, Red Hat Linux
@@ -310,7 +322,7 @@ Run `oxidized` again to take the first backups.
 
 ### Ubuntu SystemV init setup
 
-The init script assumes that you have a used named 'oxidized' and that oxidized is in one of the following paths:
+The init script assumes that you have a user named 'oxidized' and that oxidized is in one of the following paths:
 
 ```text
 /sbin

data/bin/oxidized

@@ -4,7 +4,7 @@
 trap("INT") { exit } # sinatra will otherwise steal this from us
 
 begin
-  require 'oxidized/cli'
+  require_relative '../lib/oxidized/cli'
   Oxidized::CLI.new.run
 rescue => error
   warn "#{error}"

data/docs/Configuration.md

@@ -62,22 +62,31 @@ vars:
   ssh_no_exec: true
 ```
 
+## Disabling SSH keepalives
+
+Oxidized SSH input makes use of SSH keepalives to prevent timeouts from slower devices and to quickly tear down stale sessions in larger deployments. There have been reports of SSH keepalives breaking compatibility with certain OS types. They can be disabled using the `ssh_no_keepalive` variable on a per-node basis (by specifying it in the source) or configured application-wide.
+
+```yaml
+vars:
+  ssh_no_keepalive: true
+```
+
 ## SSH Auth Methods
 
 By default, Oxidized registers the following auth methods: `none`, `publickey` and `password`. However you can configure this globally, by groups, models or nodes.
 
 ```yaml
 vars:
-    auth_methods: [ "none", "publickey", "password", "keyboard-interactive" ]
+  auth_methods: [ "none", "publickey", "password", "keyboard-interactive" ]
 ```
 
 ## SSH Proxy Command
 
-Oxidized can `ssh` through a proxy as well. To do so we just need to set `ssh_proxy` variable with the proxy host information.
+Oxidized can `ssh` through a proxy as well. To do so we just need to set `ssh_proxy` variable with the proxy host information and optionally set the `ssh_proxy_port` with the SSH port if it is not listening no port 22.
 
 This can be provided on a per-node basis by mapping the proper fields from your source.
 
-An example for a `csv` input source that maps the 4th field as the `ssh_proxy` value.
+An example for a `csv` input source that maps the 4th field as the `ssh_proxy` value and the 5th field as `ssh_proxy_port`.
 
 ```yaml
 ...
@@ -87,6 +96,27 @@ map:
 vars_map:
   enable: 2
   ssh_proxy: 3
+  ssh_proxy_port: 4
+...
+```
+
+## SSH enabling legacy algorithms
+
+When connecting to older firmware over SSH, it is sometimes necessary to enable legacy/disabled settings like KexAlgorithms, HostKeyAlgorithms, MAC or the Encryption.
+
+These settings can be provided on a per-node basis by mapping the ssh_kex, ssh_host_key, ssh_hmac and the ssh_encryption fields from you source.
+
+```yaml
+...
+map:
+  name: 0
+  model: 1
+vars_map:
+  enable: 2
+  ssh_kex: 3
+  ssh_host_key: 4
+  ssh_hmac: 5
+  ssh_encryption: 6
 ...
 ```
 
@@ -116,6 +146,9 @@ threads: 30
 timeout: 20
 retries: 3
 prompt: !ruby/regexp /^([\w.@-]+[#>]\s?)$/
+crash:
+  directory: ~/.config/oxidized/crashes
+  hostnames: false
 vars:
   enable: S3cr3tx
 groups: {}
@@ -174,6 +207,8 @@ map:
 
 For model specific credentials
 
+You can add 'username: nil' if the device only expects a Password at prompt.
+
 ```yaml
 models:
   junos:
@@ -187,6 +222,9 @@ models:
   apc_aos:
     username: apc
     password: password
+  cisco:
+    username: nil
+    password: pass
 ```
 
 ## RESTful API and Web Interface

data/docs/Hooks.md

@@ -168,6 +168,7 @@ hooks:
     token: SLACK_BOT_TOKEN
     channel: "#network-changes"
 ```
+The token parameter is a "legacy token" and is generated [Here](https://api.slack.com/custom-integrations/legacy-tokens).
 
 Optionally you can disable snippets and post a formatted message, for instance linking to a commit in a git repo. Named parameters `%{node}`, `%{group}`, `%{model}` and `%{commitref}` are available.
 
@@ -184,6 +185,18 @@ hooks:
 
 Note the channel name must be in quotes.
 
+A proxy can optionally be specified if needed to reach the Slack API endpoint.
+
+```yaml
+hooks:
+  slack:
+    type: slackdiff
+    events: [post_store]
+    token: SLACK_BOT_TOKEN
+    channel: "#network-changes"
+    proxy: http://myproxy:8080
+```
+
 ## Hook type: ciscosparkdiff
 
 The `ciscosparkdiff` hook posts config diffs to a [Cisco Spark](https://www.ciscospark.com/) space of your choice. It only triggers for `post_store` events.
@@ -221,6 +234,19 @@ hooks:
 
 Note the space and access tokens must be in quotes.
 
+A proxy can optionally be specified if needed to reach the Spark API endpoint.
+
+```yaml
+hooks:
+  ciscospark:
+    type: ciscosparkdiff
+    events: [post_store]
+    accesskey: SPARK_BOT_API_OR_OAUTH_KEY
+    space: SPARK_SPACE_ID
+    diff: true
+    proxy: http://myproxy:8080
+```
+
 ## Hook type: xmppdiff
 
 The `xmppdiff` hook posts config diffs to a [XMPP](https://en.wikipedia.org/wiki/XMPP) chatroom of your choice. It only triggers for `post_store` events.

data/docs/Model-Notes/AireOS.md

@@ -1,5 +1,4 @@
-Cisco WLC Configuration
-=======================
+# Cisco WLC Configuration
 
 Create a user with read-write privilege:
 

data/docs/Model-Notes/ArbOS.md

@@ -1,5 +1,4 @@
-Arbor Networks ArbOS notes
-==========================
+# Arbor Networks ArbOS notes
 
 If you are running ArbOS version 7 or lower then you may need to update the model to remove `exec true`:
 

data/docs/Model-Notes/Comware.md

@@ -1,5 +1,4 @@
-Comware Configuration
-=====================
+# Comware Configuration
 
 If you find 3Com Comware devices aren't being backed up this may be due to prompt detection not matching because a previous login message is disabled after the first prompt.
 

data/docs/Model-Notes/EOS.md

@@ -1,5 +1,4 @@
-Arista EOS Configuration
-========================
+# Arista EOS Configuration
 
 By default, EOS requires the `keyboard-interactive` SSH authentication method for a successful SSH login. To add support for this method to your Oxidized configuration, see the [SSH Auth Methods](../Configuration.md#ssh-auth-methods) directive.
 

data/docs/Model-Notes/JunOS.md

@@ -1,5 +1,4 @@
-JunOS Configuration
-===================
+# JunOS Configuration
 
 Create login class cfg-view
 

data/docs/Model-Notes/Netgear.md

@@ -1,9 +1,8 @@
-Netgear Configuration
-=====================
+# Netgear Configuration
 
 There are several models available with CLI management via telnet (port 60000), but they all behave like one of the following:
 
-### Older models:
+## Older models
 
 ```text
 Connected to 192.168.3.201.
@@ -19,7 +18,7 @@ Password:
 (GS748Tv4) #show running-config
 ```
 
-### Newer models:
+## Newer models
 
 ```text
 Connected to 172.0.3.203.
@@ -47,7 +46,7 @@ Configuration for older/newer models: make sure you have defined variable 'enabl
 
 One possible configuration:
 
-### oxidized config
+## oxidized config
 
 ```yaml
 source:
@@ -65,7 +64,7 @@ source:
       telnet_port: 5
 ```
 
-### router.db
+## router.db
 
 ```text
 switchOldFW:netgear:admin:adminpw::60000

data/docs/Model-Notes/Nokia.md

@@ -0,0 +1,9 @@
+# Nokia
+
+## Nokia ISAM and SSH keepalives
+
+Nokia ISAM might require disabling SSH keepalives.
+
+[Reference](https://github.com/ytti/oxidized/issues/1482)
+
+Back to [Model-Notes](README.md)

data/docs/Model-Notes/README.md

@@ -1,5 +1,4 @@
-Model Notes
-===========
+# Model Notes
 
 This directory contains implementation notes and caveats to assist you in your oxidized deployment.
 
@@ -15,6 +14,8 @@ Cumulus|[Cumulus](Cumulus.md)|11 Jun 2018
 Huawei|[VRP](VRP-Huawei.md)|17 Nov 2017
 Juniper|[MX/QFX/EX/SRX/J Series](JunOS.md)|18 Jan 2018
 Netgear|[Netgear](Netgear.md)|11 Apr 2018
+Nokia|[Nokia ISAM](Nokia.md)|22 Aug 2018
+Viptela|[Viptela](Viptela.md)|1 Jul 2018
 Zyxel|[XGS4600 Series](XGS4600-Zyxel.md)|1 Feb 2018
 
 If you discover additional caveats or problems please make sure to consult the [GitHub issues for oxidized](https://github.com/ytti/oxidized/issues) known issues.

data/docs/Model-Notes/VRP-Huawei.md

@@ -1,5 +1,4 @@
-Huawei VRP Configuration
-========================
+# Huawei VRP Configuration
 
 Create a user with no privileges
 

data/docs/Model-Notes/Viptela.md

@@ -0,0 +1,12 @@
+# Viptela
+
+This model collects running config and other desired commands from Viptela devices.
+
+Pagination is disabled post login.
+
+## Supported Commands
+
+- show running-config
+- show version
+
+Back to [Model-Notes](README.md)