Introduction

With the release of 1.12.8 we are introducing Credential Sets (known from now on as Credentials). This functionality replaces the old configuration values of default_ssh_username, etc. Those values will be migrated into credentials if they exist when an upgrade is performed. Credentials can have one of a few different types - snmp1/2, snmpv3, ssh, ssh key, windows are all implemented. CAVEAT - ssh keys are not implemented for Windows Open-AudIT servers as yet.

 

How Does it Work?

Credentials are stored in the "credentials" database table. The actual credential information is encrypted in storage. When a Discovery is run, a device has it's credentials retrieved and tested for connection first. If these fail the list of credentials is also tested against the device. Working credentials are stored at an individual device level in the "credential" table (note - no 's' in the table name). SSH keys are tested before SSH username / password. When testing SSH, credentials will also mbe marked as working with sudo or being root.

Creating Credentials

To make another credential entry use the menu and go to menu -> Admin -> Credentials -> Create Credentials (In Open-AudIT Enterprise menu -> System -> Credentials -> Create Credentials). Provide a name and optionally a description. Choose a type of credential. Once you do this, the additional fields will populate with the available configurable options.

Viewing Credential Details

Go to menu -> Admin -> Credentials -> List Credentials.

You will see a list of available credentials. You can view a credential by clicking on the it's ID (in green). You can also edit or delete the credential.

Credentials are stored in the database in the "credentials" table. A typical entry will look as below.

NOTE - org_id is not used at present.

         id: 26
       name: Mark at home
description: 
       type: ssh
credentials: QvK89RdkKYFQrwZF3bfBeHSyHhAXdIbh2i22MsSdsnpCO72lQGoRnlpKfW+AETgmCOhIAe3NQmRucMncsaGTyeczshUCuv1iqTuk8ZT3sHyGkDPkq/FiX1z6guULcFN/
     org_id: 0
  edited_by: Administrator
edited_date: 2016-08-04 08:54:10

 

API / Web Access?

You can access the /credentials collection using the normal Open-AudIT JSON based API. Just like any other collection. Please see the API documentation for further details.

When requesting a credentials details via the API, the credentials section will be decrypted.

API Routes

Request Method
ID
Action
Resulting Function
URL Example
Notes
Example Response
GETn collection/credentialsReturns a list of credentials.credentials_collection.json
GETy read/credentials/{id}Returns a credentials details.credentials_read.json
PATCHy update/credentials/{id}Update an attribute of a credentials entry.credentials_patch.json
POSTn create/credentialsInsert a new credentials entry.credentials_create.json
DELETEy delete/credentials/{id}Delete a credentials entry.credentials_delete.json

Web Application Routes

Request Method
ID
Action
Resulting Function
URL Example
Notes
GETncreatecreate_form/credentials/createDisplays a standard web form for submission to POST /credentials.
GETyupdateupdate_form/credentials/{id}/updateShow the script details with the option to update attributes using PATCH to /credentials/{id}