Skip to content

Commit 64fca8c

Browse files
robertcheramyrobertcheramy
committed
fortios: remove ENC passwords from significant changes
Address issue #3176 and partly #3680 Remove the \n in pre_logout "exit\n", as \n is already added by oxidized and this collides with the unit test. Add a YAML Simulation file for fortios and unit tests
1 parent 9a2684c commit 64fca8c

File tree

6 files changed

+304
-2
lines changed

6 files changed

+304
-2
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
1212

1313
### Changed
1414
- Refactored models: Use `keep_lines` and `reject_lines` in aosw, arubainstant, asa, efos, firelinuxos, fsos, ironware, mlnxos and perle to (@robertcheramy)
15-
- Modified models to support store mode on significant changes: ios (@robertcheramy)
15+
- Modified models to support store mode on significant changes: ios, fortios (@robertcheramy)
1616

1717
### Fixed
1818
- apc_aos: set comment to "; " to match comments in config.ini (@robertcheramy)

‎lib/oxidized/model/fortios.rb‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -108,12 +108,18 @@ class FortiOS < Oxidized::Model
108108
cfg.join
109109
end
110110

111+
cmd :significant_changes do |cfg|
112+
cfg.reject_lines [
113+
/^ +set \S+ ENC \S+$/
114+
]
115+
end
116+
111117
cfg :telnet do
112118
username /^[lL]ogin:/
113119
password /^Password:/
114120
end
115121

116122
cfg :telnet, :ssh do
117-
pre_logout "exit\n"
123+
pre_logout "exit"
118124
end
119125
end

‎spec/model/data/fortios#FortiGate-91G_7.4.7#output.txt‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
# # COMMAND: get system status
2+
# Version: FortiGate-91G v7.4.7,build2731,250120 (GA.M)
3+
# First GA patch build date: 230509
4+
# Security Level: High
5+
# Firmware Signature: certified
6+
# Virus-DB <db version stripped>
7+
# Extended DB <db version stripped>
8+
# AV AI/ML Model <db version stripped>
9+
# IPS-DB <db version stripped>
10+
# IPS-ETDB <db version stripped>
11+
# APP-DB <db version stripped>
12+
# Proxy-IPS-DB <db version stripped>
13+
# Proxy-IPS-ETDB <db version stripped>
14+
# Proxy-APP-DB <db version stripped>
15+
# FMWP-DB <db version stripped>
16+
# IPS Malicious URL Database <db version stripped>
17+
# IoT-Detect <db version stripped>
18+
# OT-Detect-DB: 0.00000(2001-01-01 00:00)
19+
# OT-Patch-DB: 0.00000(2001-01-01 00:00)
20+
# OT-Threat-DB: 6.00741(2015-12-01 02:30)
21+
# IPS-Engine: 7.00559(2024-12-05 01:06)
22+
# Serial-Number: FGT91GTK00000000
23+
# BIOS version: 06000100
24+
# System Part-Number: P28792-06
25+
# Log hard disk: Available
26+
# Hostname: TEST-FW1234
27+
# Private Encryption: Disable
28+
# Operation Mode: NAT
29+
# Current virtual domain: root
30+
# Max number of virtual domains: 10
31+
# Virtual domains status: 1 in NAT mode, 0 in TP mode
32+
# Virtual domain configuration: disable
33+
# FIPS-CC mode: disable
34+
# Current HA mode: standalone
35+
# Branch point: 2731
36+
# Release Version Information: GA
37+
# System time: <stripped>
38+
# Last reboot reason: warm reboot
39+
#
40+
# # COMMAND: get system ha status
41+
# HA Health Status: OK
42+
# Model: FortiGate-91G
43+
# Mode: Standalone
44+
# # COMMAND: get hardware status
45+
# Model name: FortiGate-91G
46+
# ASIC version: SOC5
47+
# CPU: ARMv8
48+
# Number of CPUs: 8
49+
# RAM: 7547 MB
50+
# EMMC: 9982 MB(MLC) /dev/mmcblk0
51+
# Hard disk: 114473 MB /dev/nvme0n1
52+
# USB Flash: not available
53+
# Network Card chipset: FortiASIC NP7LITE Adapter (rev.)
54+
# Hardware Revision: Rev1
55+
#
56+
# COMMAND: show | grep .
57+
#config-version=FGT91G-7.4.7-FW-build2731-250120:opmode=1:vdom=0:user=TACACS-USER
58+
#conf_file_ver=<stripped>
59+
#buildno=2731
60+
#global_vdom=1
61+
config system global
62+
set admin-restrict-local enable
63+
set alias "FortiGate-91G"
64+
set hostname "TEST-FW1234"
65+
set lldp-reception enable
66+
set lldp-transmission enable
67+
set switch-controller enable
68+
set timezone "Europe/Berlin"
69+
set virtual-switch-vlan enable
70+
end
71+
config system interface
72+
edit "wan1"
73+
set vdom "root"
74+
set ip 192.0.2.2 255.255.255.240
75+
set allowaccess ping https ssh snmp http fgfm ftm
76+
set type physical
77+
set alias "outside"
78+
set monitor-bandwidth enable
79+
set role wan
80+
set snmp-index 1
81+
set speed 10000auto
82+
next
83+
end
84+
config system admin
85+
edit "oxidized"
86+
set trusthost1 192.0.2.0 255.255.255.0
87+
set accprofile "super_admin"
88+
set vdom "root"
89+
set password ENC AAAAAAAAAABBBBBBBBBBCCCCCCCCCC
90+
next
91+
end
92+
config system snmp user
93+
edit "snmpuser"
94+
set notify-hosts 192.0.2.10 192.0.2.11
95+
set events cpu-high mem-low log-full intf-ip vpn-tun-up vpn-tun-down ips-signature av-virus av-oversize av-pattern av-fragmented fm-if-change av-conserve av-bypass av-oversize-passed av-oversize-blocked ips-pkg-update ips-fail-open temperature-high voltage-alert faz-disconnect device-new per-cpu-high
96+
set security-level auth-priv
97+
set auth-pwd ENC AAAAAAAAAABBBBBBBBBBCCCCCCCCCC
98+
set priv-pwd ENC AAAAAAAAAABBBBBBBBBBCCCCCCCCCC
99+
next
100+
end
101+
config vpn certificate local
102+
edit "Fortinet_CA_SSL"
103+
set password ENC AAAAAAAAAABBBBBBBBBBCCCCCCCCCC
104+
set comments "This is the default CA certificate the SSL Inspection will use when generating new server certificates."
105+
set range global
106+
set source factory
107+
next
108+
end
109+
config user tacacs+
110+
edit "tacacs-server-name"
111+
set server "192.0.2.19"
112+
set secondary-server "192.0.2.20"
113+
set key ENC AAAAAAAAAABBBBBBBBBBCCCCCCCCCC
114+
set secondary-key ENC AAAAAAAAAABBBBBBBBBBCCCCCCCCCC
115+
set authorization enable
116+
next
117+
end
118+
config firewall ssh local-key
119+
edit "Fortinet_SSH_RSA2048"
120+
set password ENC AAAAAAAAAABBBBBBBBBBCCCCCCCCCC
121+
set source built-in
122+
next
123+
end
124+
config firewall ssh local-ca
125+
edit "Fortinet_SSH_CA"
126+
set password ENC AAAAAAAAAABBBBBBBBBBCCCCCCCCCC
127+
set source built-in
128+
next
129+
end
130+
config router multicast
131+
end
132+

‎spec/model/data/fortios#FortiGate-91G_7.4.7#secret.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
fail:
2+
- 'AAAAAAAAAABBBBBBBBBBCCCCCCCCCC'

‎spec/model/data/fortios#FortiGate-91G_7.4.7#significant_changes.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
fail:
2+
- 'ENC AAAAAAAAAABBBBBBBBBBCCCCCCCCCC'

‎spec/model/data/fortios#FortiGate-91G_7.4.7#simulation.yaml‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
---
2+
init_prompt: |-
3+
TEST-FW1234 #\x20
4+
commands:
5+
- "get system status\n": |-
6+
get system status\r
7+
Version: FortiGate-91G v7.4.7,build2731,250120 (GA.M)
8+
First GA patch build date: 230509
9+
Security Level: High
10+
Firmware Signature: certified
11+
Virus-DB: 1.00000(2018-04-09 18:07)
12+
Extended DB: 1.00000(2018-04-09 18:07)
13+
AV AI/ML Model: 0.00000(2001-01-01 00:00)
14+
IPS-DB: 6.00741(2015-12-01 02:30)
15+
IPS-ETDB: 0.00000(2001-01-01 00:00)
16+
APP-DB: 6.00741(2015-12-01 02:30)
17+
Proxy-IPS-DB: 6.00741(2015-12-01 02:30)
18+
Proxy-IPS-ETDB: 0.00000(2001-01-01 00:00)
19+
Proxy-APP-DB: 6.00741(2015-12-01 02:30)
20+
FMWP-DB: 25.00121(2025-12-16 08:01)
21+
IPS Malicious URL Database: 1.00001(2015-01-01 01:01)
22+
IoT-Detect: 0.00000(2022-08-17 17:31)
23+
OT-Detect-DB: 0.00000(2001-01-01 00:00)
24+
OT-Patch-DB: 0.00000(2001-01-01 00:00)
25+
OT-Threat-DB: 6.00741(2015-12-01 02:30)
26+
IPS-Engine: 7.00559(2024-12-05 01:06)
27+
Serial-Number: FGT91GTK00000000
28+
BIOS version: 06000100
29+
--More--\x20
30+
- " ": |-
31+
\r \rSystem Part-Number: P28792-06
32+
Log hard disk: Available
33+
Hostname: TEST-FW1234
34+
Private Encryption: Disable
35+
Operation Mode: NAT
36+
Current virtual domain: root
37+
Max number of virtual domains: 10
38+
Virtual domains status: 1 in NAT mode, 0 in TP mode
39+
Virtual domain configuration: disable
40+
FIPS-CC mode: disable
41+
Current HA mode: standalone
42+
Branch point: 2731
43+
Release Version Information: GA
44+
System time: Wed Jan 7 14:30:09 2026
45+
Last reboot reason: warm reboot
46+
47+
TEST-FW1234 #\x20
48+
- "get system ha status\n": |-
49+
get system ha status\r
50+
HA Health Status: OK
51+
Model: FortiGate-91G
52+
Mode: Standalone
53+
Group Name:\x20
54+
Group ID: 0
55+
Debug: 0
56+
Cluster Uptime: 0 days 0h:0m:0s
57+
Cluster state change time: N/A
58+
ses_pickup: disable
59+
override: disable
60+
System Usage stats:
61+
HBDEV stats:
62+
number of member: 0
63+
number of vcluster: 0
64+
65+
TEST-FW1234 #\x20
66+
- "get hardware status\n": |-
67+
get hardware status\r
68+
Model name: FortiGate-91G
69+
ASIC version: SOC5
70+
CPU: ARMv8
71+
Number of CPUs: 8
72+
RAM: 7547 MB
73+
EMMC: 9982 MB(MLC) /dev/mmcblk0
74+
Hard disk: 114473 MB /dev/nvme0n1
75+
USB Flash: not available
76+
Network Card chipset: FortiASIC NP7LITE Adapter (rev.)
77+
Hardware Revision: Rev1
78+
79+
TEST-FW1234 #\x20
80+
- "show | grep .\n": |-
81+
show | grep .\r
82+
#config-version=FGT91G-7.4.7-FW-build2731-250120:opmode=1:vdom=0:user=TACACS-USER
83+
#conf_file_ver=440000000000001
84+
#buildno=2731
85+
#global_vdom=1
86+
config system global
87+
set admin-restrict-local enable
88+
set alias \"FortiGate-91G\"
89+
set hostname \"TEST-FW1234\"
90+
set lldp-reception enable
91+
set lldp-transmission enable
92+
set switch-controller enable
93+
set timezone \"Europe/Berlin\"
94+
set virtual-switch-vlan enable
95+
end
96+
config system interface
97+
edit \"wan1\"
98+
set vdom \"root\"
99+
set ip 192.0.2.2 255.255.255.240
100+
set allowaccess ping https ssh snmp http fgfm ftm
101+
set type physical
102+
set alias \"outside\"
103+
set monitor-bandwidth enable
104+
set role wan
105+
set snmp-index 1
106+
set speed 10000auto
107+
next
108+
end
109+
config system admin
110+
edit \"oxidized\"
111+
set trusthost1 192.0.2.0 255.255.255.0
112+
set accprofile \"super_admin\"
113+
set vdom \"root\"
114+
set password ENC AAAAAAAAAABBBBBBBBBBCCCCCCCCCC
115+
next
116+
end
117+
config system snmp user
118+
edit \"snmpuser\"
119+
set notify-hosts 192.0.2.10 192.0.2.11
120+
set events cpu-high mem-low log-full intf-ip vpn-tun-up vpn-tun-down ips-signature av-virus av-oversize av-pattern av-fragmented fm-if-change av-conserve av-bypass av-oversize-passed av-oversize-blocked ips-pkg-update ips-fail-open temperature-high voltage-alert faz-disconnect device-new per-cpu-high
121+
set security-level auth-priv
122+
set auth-pwd ENC AAAAAAAAAABBBBBBBBBBCCCCCCCCCC
123+
set priv-pwd ENC AAAAAAAAAABBBBBBBBBBCCCCCCCCCC
124+
next
125+
end
126+
config vpn certificate local
127+
edit \"Fortinet_CA_SSL\"
128+
set password ENC AAAAAAAAAABBBBBBBBBBCCCCCCCCCC
129+
set comments \"This is the default CA certificate the SSL Inspection will use when generating new server certificates.\"
130+
set range global
131+
set source factory
132+
next
133+
end
134+
config user tacacs+
135+
edit \"tacacs-server-name\"
136+
set server \"192.0.2.19\"
137+
set secondary-server \"192.0.2.20\"
138+
set key ENC AAAAAAAAAABBBBBBBBBBCCCCCCCCCC
139+
set secondary-key ENC AAAAAAAAAABBBBBBBBBBCCCCCCCCCC
140+
set authorization enable
141+
next
142+
end
143+
config firewall ssh local-key
144+
edit \"Fortinet_SSH_RSA2048\"
145+
set password ENC AAAAAAAAAABBBBBBBBBBCCCCCCCCCC
146+
set source built-in
147+
next
148+
end
149+
config firewall ssh local-ca
150+
edit \"Fortinet_SSH_CA\"
151+
set password ENC AAAAAAAAAABBBBBBBBBBCCCCCCCCCC
152+
set source built-in
153+
next
154+
end
155+
config router multicast
156+
end
157+
158+
TEST-FW1234 #\x20
159+
- "exit\n": |-
160+
exit\r

0 commit comments

Comments
 (0)