Skip to content

Commit ab09303

Browse files
davidpil2002davidpil2002
authored
[YANG] Add support for Password Hardening (#10322)
- Why I did it Yang Model about password hardening feature, the sonic CLI of this feature was autogenerated from this Yang model - How I did it Create new Yang model in src/sonic-yang-models/yang-models/sonic-passwh.yang. - How to verify it There are unitests(yang test) in this P.R covering all the passwords policies with good and bad values cases. Or is possible manually using the config/show password commands that were autogenerated from this Yang model. (this CLI code added in sonic-utilities)
1 parent 29043ff commit ab09303

File tree

7 files changed

+319
-0
lines changed

7 files changed

+319
-0
lines changed

‎files/build_templates/init_cfg.json.j2

+14
Original file line numberDiff line numberDiff line change
@@ -91,5 +91,19 @@
9191
"rate_limit_interval" : "600"
9292
}{%if not loop.last %},{% endif -%}
9393
{% endfor %}
94+
},
95+
"PASSW_HARDENING": {
96+
"POLICIES":{
97+
"state": "disabled",
98+
"expiration": "180",
99+
"expiration_warning": "15",
100+
"history_cnt": "10",
101+
"len_min": "8",
102+
"reject_user_passw_match": "true",
103+
"lower_class": "true",
104+
"upper_class": "true",
105+
"digits_class": "true",
106+
"special_class": "true"
107+
}
94108
}
95109
}

‎src/sonic-yang-models/doc/Configuration.md

+35
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ Table of Contents
5151
* [VLAN_MEMBER](#vlan_member)
5252
* [Virtual router](#virtual-router)
5353
* [WRED_PROFILE](#wred_profile)
54+
* [PASSWORD_HARDENING](#password_hardening)
5455
* [For Developers](#for-developers)
5556
* [Generating Application Config by Jinja2 Template](#generating-application-config-by-jinja2-template)
5657
* [Incremental Configuration by Subscribing to ConfigDB](#incremental-configuration-by-subscribing-to-configdb)
@@ -1506,6 +1507,40 @@ The packet action could be:
15061507
}
15071508
}
15081509
```
1510+
### PASSWORD_HARDENING
1511+
1512+
Password Hardening, a user password is the key credential used in order to verify the user accessing the switch and acts as the first line of defense in regards to securing the switch. PASSWORD_HARDENING - support the enforce strong policies.
1513+
1514+
- state - Enable/Disable password hardening feature
1515+
- len_min - The minimum length of the PW should be subject to a user change.
1516+
- expiration - PW Age Change Once a PW change takes place - the DB record for said PW is updated with the new PW value and a fresh new age (=0).
1517+
- expiration_warning - The switch will provide a warning for PW change before and (this is to allow a sufficient warning for upgrading the PW which might be relevant to numerous switches).
1518+
- history_cnt - remember last passwords, and reject to use the old passw
1519+
- reject_user_passw_match - reject to set same username and passw
1520+
- PW classes - are the type of characters the user is required to enter when setting/updating a PW.
1521+
There are 4 classes
1522+
- lower_class - Small characters - a-z
1523+
- upper_class - Big characters - A-Z
1524+
- digits_class -Numbers - 0-9
1525+
- special_class - Special Characters `~!@#$%^&*()-_+=|[{}];:',<.>/? and white space
1526+
```
1527+
{
1528+
"PASSW_HARDENING": {
1529+
"POLICIES": {
1530+
"state": "disabled",
1531+
"expiration": "180",
1532+
"expiration_warning": "15",
1533+
"history_cnt": "10",
1534+
"len_min": "8",
1535+
"reject_user_passw_match": "true",
1536+
"lower_class": "true",
1537+
"upper_class": "true",
1538+
"digits_class": "true",
1539+
"special_class": "true"
1540+
}
1541+
}
1542+
}
1543+
```
15091544

15101545
### BREAKOUT_CFG
15111546

‎src/sonic-yang-models/setup.py

+1
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,7 @@ def run(self):
114114
'./yang-models/sonic-ntp.yang',
115115
'./yang-models/sonic-nat.yang',
116116
'./yang-models/sonic-nvgre-tunnel.yang',
117+
'./yang-models/sonic-passwh.yang',
117118
'./yang-models/sonic-pbh.yang',
118119
'./yang-models/sonic-port.yang',
119120
'./yang-models/sonic-policer.yang',

‎src/sonic-yang-models/tests/files/sample_config_db.json

+15
Original file line numberDiff line numberDiff line change
@@ -1792,6 +1792,21 @@
17921792
}
17931793
},
17941794

1795+
"PASSW_HARDENING": {
1796+
"POLICIES": {
1797+
"state": "enabled",
1798+
"expiration": "180",
1799+
"expiration_warning": "15",
1800+
"history_cnt": "10",
1801+
"len_min": "8",
1802+
"reject_user_passw_match": "true",
1803+
"digits_class": "true",
1804+
"lower_class": "true",
1805+
"special_class": "true",
1806+
"upper_class": "true"
1807+
}
1808+
},
1809+
17951810
"MACSEC_PROFILE": {
17961811
"test": {
17971812
"priority": "64",

‎src/sonic-yang-models/tests/yang_model_tests/tests/password_hardening.json

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
{
2+
"PASSWORD_TABLE": {
3+
"desc": "Configure policer with all default fields."
4+
},
5+
"PASSWORD_ENABLE_FEATURE_WITH_POLICIES": {
6+
"desc": "Configure password policies and enabled feature."
7+
},
8+
"PASSWORD_BAD_ENABLE_FEATURE": {
9+
"desc": "Configure password policies enabled feature with a wrong value.",
10+
"eStrKey" : "InvalidValue"
11+
},
12+
"PASSWORD_BAD_DIGIT": {
13+
"desc": "Configure password Digit Class policy with invalid value",
14+
"eStrKey" : "InvalidValue"
15+
},
16+
"PASSWORD_BAD_HISTORY_CNT": {
17+
"desc": "Configure password history_cnt with out of range value",
18+
"eStrKey" : "InvalidValue"
19+
},
20+
"PASSWORD_BAD_LEN_MIN": {
21+
"desc": "Configure password len-min with out of range value",
22+
"eStrKey" : "Pattern"
23+
},
24+
"PASSWORD_BAD_EXPIRATION": {
25+
"desc": "Configure password expiration with out of range value",
26+
"eStrKey" : "Pattern"
27+
},
28+
"PASSWORD_BAD_EXPIRATION_WARN": {
29+
"desc": "Configure password expiration-warning with out of range value",
30+
"eStrKey" : "Pattern"
31+
}
32+
}

‎src/sonic-yang-models/tests/yang_model_tests/tests_config/password_hardening.json

+146
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
{
2+
"PASSWORD_TABLE": {
3+
"sonic-passwh:sonic-passwh": {
4+
"sonic-passwh:PASSW_HARDENING": {
5+
"POLICIES":{
6+
"state": "disabled",
7+
"expiration": "180",
8+
"expiration_warning": "15",
9+
"history_cnt": "10",
10+
"len_min": "8",
11+
"reject_user_passw_match": true,
12+
"lower_class": true,
13+
"upper_class": true,
14+
"digits_class": true,
15+
"special_class": true
16+
}
17+
}
18+
}
19+
},
20+
"PASSWORD_ENABLE_FEATURE_WITH_POLICIES": {
21+
"sonic-passwh:sonic-passwh": {
22+
"sonic-passwh:PASSW_HARDENING": {
23+
"POLICIES":{
24+
"state": "enabled",
25+
"expiration": "180",
26+
"expiration_warning": "15",
27+
"history_cnt": "10",
28+
"len_min": "8",
29+
"reject_user_passw_match": true,
30+
"lower_class": true,
31+
"upper_class": true,
32+
"digits_class": true,
33+
"special_class": true
34+
}
35+
}
36+
}
37+
},
38+
"PASSWORD_BAD_ENABLE_FEATURE": {
39+
"sonic-passwh:sonic-passwh": {
40+
"sonic-passwh:PASSW_HARDENING": {
41+
"POLICIES":{
42+
"state": "33",
43+
"expiration": "180",
44+
"expiration_warning": "15",
45+
"history_cnt": "10",
46+
"len_min": "8",
47+
"reject_user_passw_match": true,
48+
"lower_class": true,
49+
"upper_class": true,
50+
"digits_class": true,
51+
"special_class": true
52+
}
53+
}
54+
}
55+
},
56+
"PASSWORD_BAD_DIGIT": {
57+
"sonic-passwh:sonic-passwh": {
58+
"sonic-passwh:PASSW_HARDENING": {
59+
"POLICIES":{
60+
"state": "disabled",
61+
"expiration": "180",
62+
"expiration_warning": "15",
63+
"history_cnt": "10",
64+
"len_min": "8",
65+
"reject_user_passw_match": true,
66+
"lower_class": true,
67+
"upper_class": true,
68+
"digits_class": "1",
69+
"special_class": true
70+
}
71+
}
72+
}
73+
},
74+
"PASSWORD_BAD_HISTORY_CNT": {
75+
"sonic-passwh:sonic-passwh": {
76+
"sonic-passwh:PASSW_HARDENING": {
77+
"POLICIES":{
78+
"state": "enabled",
79+
"expiration": "180",
80+
"expiration_warning": "15",
81+
"history_cnt": "300",
82+
"len_min": "8",
83+
"reject_user_passw_match": true,
84+
"lower_class": true,
85+
"upper_class": true,
86+
"digits_class": true,
87+
"special_class": true
88+
}
89+
}
90+
}
91+
},
92+
"PASSWORD_BAD_LEN_MIN": {
93+
"sonic-passwh:sonic-passwh": {
94+
"sonic-passwh:PASSW_HARDENING": {
95+
"POLICIES":{
96+
"state": "enabled",
97+
"expiration": "180",
98+
"expiration_warning": "15",
99+
"history_cnt": "50",
100+
"len_min": "50",
101+
"reject_user_passw_match": true,
102+
"lower_class": true,
103+
"upper_class": true,
104+
"digits_class": true,
105+
"special_class": true
106+
}
107+
}
108+
}
109+
},
110+
"PASSWORD_BAD_EXPIRATION": {
111+
"sonic-passwh:sonic-passwh": {
112+
"sonic-passwh:PASSW_HARDENING": {
113+
"POLICIES":{
114+
"state": "enabled",
115+
"expiration": "400",
116+
"expiration_warning": "15",
117+
"history_cnt": "50",
118+
"len_min": "8",
119+
"reject_user_passw_match": true,
120+
"lower_class": true,
121+
"upper_class": true,
122+
"digits_class": true,
123+
"special_class": true
124+
}
125+
}
126+
}
127+
},
128+
"PASSWORD_BAD_EXPIRATION_WARN": {
129+
"sonic-passwh:sonic-passwh": {
130+
"sonic-passwh:PASSW_HARDENING": {
131+
"POLICIES":{
132+
"state": "enabled",
133+
"expiration": "180",
134+
"expiration_warning": "40",
135+
"history_cnt": "10",
136+
"len_min": "8",
137+
"reject_user_passw_match": true,
138+
"lower_class": true,
139+
"upper_class": true,
140+
"digits_class": true,
141+
"special_class": true
142+
}
143+
}
144+
}
145+
}
146+
}

‎src/sonic-yang-models/yang-models/sonic-passwh.yang

+76
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
module sonic-passwh {
2+
yang-version 1.1;
3+
namespace "http://github.com/Azure/sonic-passwh";
4+
prefix password;
5+
6+
description "PASSWORD HARDENING YANG Module for SONiC OS";
7+
8+
revision 2022-05-03 {
9+
description "First Revision";
10+
}
11+
12+
container sonic-passwh {
13+
14+
typedef feature_state {
15+
type enumeration {
16+
enum enabled;
17+
enum disabled;
18+
}
19+
}
20+
21+
container PASSW_HARDENING {
22+
description "PASSWORD HARDENING part of config_db.json";
23+
container POLICIES {
24+
leaf state {
25+
description "state of the feature";
26+
type feature_state;
27+
default "disabled";
28+
}
29+
leaf expiration {
30+
description "expiration time (days unit)";
31+
type uint16 {
32+
range 1..365;
33+
}
34+
}
35+
leaf expiration_warning {
36+
description "expiration warning time (days unit)";
37+
type uint8 {
38+
range 1..30;
39+
}
40+
}
41+
leaf history_cnt {
42+
description "num of old password that the system will recorded";
43+
type uint8 {
44+
range 1..100;
45+
}
46+
}
47+
leaf len_min {
48+
description "password min length";
49+
type uint8 {
50+
range 1..32;
51+
}
52+
}
53+
leaf reject_user_passw_match{
54+
description "username password match";
55+
type boolean;
56+
}
57+
leaf lower_class{
58+
description "password lower chars policy";
59+
type boolean;
60+
}
61+
leaf upper_class{
62+
description "password upper chars policy";
63+
type boolean;
64+
}
65+
leaf digits_class{
66+
description "password digits chars policy";
67+
type boolean;
68+
}
69+
leaf special_class{
70+
description "password special chars policy";
71+
type boolean;
72+
}
73+
}/*container policies */
74+
} /* container PASSWH */
75+
}/* container sonic-passwh */
76+
}/* end of module sonic-passwh */

0 commit comments

Comments
 (0)