<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:'Times New Roman', Times, serif;">
<p>I know one person that installed Rancid on an encrypted USB drive. It doesn't eliminate the risk of cleartext passwords in .cloginrc but it does reduce the exposure.</p>
<p><br>
</p>
<p>Regards,</p>
<p>Lee</p>
<p><br>
</p>
<p><br>
</p>
<div style="word-wrap:break-word; color:rgb(0,0,0); font-size:14px; font-family:Calibri,sans-serif">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" color="#000000" face="Calibri, sans-serif"><b>From:</b> Rancid-discuss <rancid-discuss-bounces@shrubbery.net> on behalf of Matt Almgren <matta@surveymonkey.com><br>
<b>Sent:</b> Tuesday, May 5, 2015 2:38 PM<br>
<b>To:</b> rancid-discuss@shrubbery.net<br>
<b>Subject:</b> Re: [rancid] Alternatives to cleartext password in .cloginrc ?</font>
<div> </div>
</div>
<div>
<div>
<div>
<div><br>
</div>
<div>
<div>BTW, I have read some interesting replies in the mailing list archives:</div>
<div><br>
</div>
<div>
<div><b>If your poller is not secure it doesn't matter what authentication </b><b>method you use.</b> So while you could for some platforms set up .shosts or RSA authorized keys, it doesn't really accomplish anything.</div>
<div><br>
</div>
<div>And</div>
<div><br>
</div>
<div>If something automated is going to log into a router, it needs an authentication credential. That's going to have to be stored somewhere. If you store it encrypted, then you're going to need to store the decryption key somewhere. <b>All that does is
rearrange the exposure, not solve it.</b></div>
<div style="font-family:Calibri"><br>
</div>
<div style="font-family:Calibri">And</div>
<div style="font-family:Calibri"><br>
</div>
<div style="font-family:Calibri">
<pre style="widows:1"><font face="Calibri">If you <b>use a TACACS server for authentication, then you could do some interesting things to make the passwords RANCID uses less useful to outsiders </b>- for example, the TACACS server could only allow the RANCID username to be used from the RANCID host, or during certain times of day, or only allow it to execute a limited subset of commands.</font></pre>
<div><font face="Calibri"><br>
</font></div>
</div>
</div>
<div><br>
</div>
<div>I’m just wondering if there’s any new information or ideas. </div>
<div><br>
</div>
<div>Thanks, Matt</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
</div>
</div>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; border-bottom:medium none; border-left:medium none; padding-bottom:0in; padding-left:0in; padding-right:0in; border-top:#b5c4df 1pt solid; border-right:medium none; padding-top:3pt">
<span style="font-weight:bold">From: </span>Matt Almgren <<a href="mailto:matta@surveymonkey.com">matta@surveymonkey.com</a>><br>
<span style="font-weight:bold">Date: </span>Tuesday, May 5, 2015 at 11:11 AM<br>
<span style="font-weight:bold">To: </span>"<a href="mailto:rancid-discuss@shrubbery.net">rancid-discuss@shrubbery.net</a>" <<a href="mailto:rancid-discuss@shrubbery.net">rancid-discuss@shrubbery.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [rancid] Alternatives to cleartext password in .cloginrc ?<br>
</div>
<div><br>
</div>
<div>
<div style="word-wrap:break-word; color:rgb(0,0,0); font-size:14px; font-family:Calibri,sans-serif">
<div>
<div>
<div><br>
</div>
</div>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div>
<div style="word-wrap:break-word; color:rgb(0,0,0); font-size:14px; font-family:Calibri,sans-serif">
<div>
<div>
<div>What are the available options, if any, to using non-cleartext passwords for Rancid in the .cloginrc file? We also use TAC+ as the backend AAA. </div>
<div><br>
</div>
<div>This wasn’t a huge concern for me until I realized that it goes against some of the PCI compliance regulations about storing passwords in the clear. </div>
<div>
<div><br>
</div>
<div>Thanks, Matt</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
</div>
</div>
</div>
</div>
</div>
</span></div>
</div>
</span></div>
</div>
</div>
</body>
</html>