support: redact secrets from the collected configuration

Private keys, password hashes and RADIUS secrets are of no use to
support and a hazard in transit.  Export the datastores with copy -r
and drop the environment dump.  --no-redact keeps them, the RPC always
redacts.

Signed-off-by: Mattias Walström <lazzer@gmail.com>

Author: mattiaswal

doc/ChangeLog.md

@@ -16,6 +16,11 @@ All notable changes to the project are documented in this file.
 - Document the release and maintenance policy: which versions receive
   updates, what may go into a patch release, and the levels of long-term
   maintenance available, see [Releases & Support][relsup]
+- `support collect` now redacts private keys, password hashes and other
+  secrets from the configuration files in the archive, use `--no-redact`
+  to keep them.  The environment dump is no longer collected
+- Add `copy -r` to export a datastore without its secrets, every node the
+  YANG models tag `nacm:default-deny-all` and user passwords are dropped
 
 ### Added
 

doc/support.md

@@ -63,7 +63,7 @@ admin@host:~$ sudo support collect -o /var/lib/support
 
 Given a directory, the file gets the canonical name shown above. Given a
 file name, that name is used. Either way the file is created with mode
-0600, since the archive contains password hashes and keys.
+0600, the archive still holds the full configuration and all logs.
 
 ## Collecting over NETCONF or RESTCONF
 
@@ -115,6 +115,7 @@ A few things to know about this path:
   descriptor and never appears in the process list. Devices built
   without the `BR2_PACKAGE_SUPPORT_ENCRYPT` option have no gpg and reject
   the request.
+- The configuration files in the archive are always redacted, see below.
 - `confd` is busy for the duration of the collection, like it is during a
   software upgrade, so a configuration change made at the same time has to
   wait for the collection to finish.
@@ -182,10 +183,27 @@ $ gpg -d support-data.tar.gz.gpg | tar xz
 The support archive includes:
 
 - System identification (hostname, uptime, kernel version)
-- Running and operational configuration (sysrepo datastores)
+- Running, operational and startup configuration, with secrets redacted
 - System logs (`/var/log` directory and live tail of messages log)
 - Network configuration and state (interfaces, routes, neighbors, bridges)
 - FRRouting information (OSPF, BFD status)
 - Container information (podman containers and their configuration)
 - System resource usage (CPU, memory, disk, processes)
 - Hardware information (PCI, USB devices, network interfaces)
+
+## Secrets in the Configuration
+
+The configuration holds private keys for SSH, TLS and WireGuard, user
+password hashes and RADIUS secrets. None of them help anyone
+troubleshoot, so `support collect` exports the configuration with
+`copy -r`, which drops every node the YANG models tag
+`nacm:default-deny-all`, plus user passwords, before writing the
+file. New models that tag their secrets are covered without changes
+here. The rest of the configuration is left intact.
+
+Pass `--no-redact` to keep them, for instance when the archive is for
+your own use and stays on your workstation. The RPC always redacts.
+
+The archive still contains every log on the device, which may hold
+usernames, addresses and other details of your network. Treat it as
+confidential and encrypt it before it leaves your control.

src/confd/yang/confd/infix-system.yang

@@ -944,16 +944,19 @@ module infix-system {
 
        The archive holds what the support(1) tool gathers: system and
        kernel logs, running and operational configuration, network and
-       hardware state.  Collection runs in RAM, so a call that returns
-       the archive inline leaves nothing behind on the device.
+       hardware state.  Private keys, password hashes and other secrets
+       are redacted from the configuration files.  Collection runs in
+       RAM, so a call that returns the archive inline leaves nothing
+       behind on the device.
 
        The system log is tailed for 5 seconds during collection, to
        keep the whole operation inside the caller's RPC timeout, see
        CONFD_TIMEOUT in /etc/default/confd.
 
-       Access is denied by default, the archive contains password
-       hashes, keys, and logs.  Only groups with an explicit NACM
-       permit rule, 'admin' in the factory configuration, may call it.";
+       Access is denied by default, the archive contains logs and the
+       full configuration, redaction notwithstanding.  Only groups with
+       an explicit NACM permit rule, 'admin' in the factory
+       configuration, may call it.";
     input {
       leaf password {
         type string {

src/support/support

@@ -18,6 +18,7 @@ cmd_collect()
     LOG_TAIL_SEC=30
     PASSWORD=""
     OUTPUT=""
+    REDACT=1
     CMD_TIMEOUT=30
     HOOK_TIMEOUT=120
 
@@ -66,9 +67,13 @@ cmd_collect()
                 OUTPUT="$2"
                 shift 2
                 ;;
+            --no-redact|-R)
+                REDACT=0
+                shift
+                ;;
             *)
                 echo "Error: Unknown option '$1'" >&2
-                echo "Usage: $prognm collect [-s N] [-p PASSWORD] [-o FILE]" >&2
+                echo "Usage: $prognm collect [-s N] [-p PASSWORD] [-o FILE] [-R]" >&2
                 exit 1
                 ;;
         esac
@@ -210,21 +215,18 @@ cmd_collect()
     collect hostname.txt hostname
     collect uptime.txt uptime
 
-    # Configuration files
-    collect running-config.json copy running
-    collect operational-config.json copy operational
+    # Configuration, copy -r drops the secrets, see 'copy -h'
+    CP=""
+    [ "$REDACT" -eq 1 ] && CP="-r"
+    collect running-config.json     copy $CP running
+    collect operational-config.json copy $CP operational
+    collect startup-config.cfg      copy $CP startup
 
     # Sysrepo YANG modules
     if command -v sysrepoctl >/dev/null 2>&1; then
         collect sysrepo-modules.txt sysrepoctl -l
     fi
 
-    # Startup config (may not exist on first boot)
-    if [ -f /cfg/startup-config.cfg ]; then
-        cp /cfg/startup-config.cfg "${COLLECT_DIR}/startup-config.cfg" 2>> "${EXEC_LOG}"
-    else
-        echo "No startup-config.cfg found" > "${COLLECT_DIR}/startup-config.cfg"
-    fi
 
     # System logs and runtime data
     if [ -d /var/log ]; then
@@ -399,9 +401,6 @@ cmd_collect()
         collect system/pstree.txt ps fax
     fi
 
-    # Environment and versions
-    collect system/env.txt env
-
     # Network sockets
     if command -v netstat >/dev/null 2>&1; then
         collect system/netstat.txt netstat -tunlp
@@ -628,6 +627,8 @@ usage()
     echo "  -p, --password [PASS]  Encrypt output with GPG. If PASS is omitted, prompts"
     echo "                         interactively or reads from stdin, so possible to do"
     echo "                         echo "\$MYSECRET" | ...   (recommended for security)"
+    echo "  -R, --no-redact        Keep private keys, password hashes and other secrets"
+    echo "                         in the collected configuration, see 'copy -h'"
     echo ""
     echo "Options for clean:"
     echo "  -n, --dry-run          Show what would be deleted without deleting"

test/case/misc/support_collect/test.adoc

@@ -1,12 +1,13 @@
 === Support Data Collection
 
-ifdef::topdoc[:imagesdir: {topdoc}../../test/case/misc/support_collect]
+ifdef::topdoc[:imagesdir: {topdoc}../../misc/support_collect]
 
 ==== Description
 
 Verify that the support-collect RPC returns a valid archive with the
-expected content, that the archive can be GPG encrypted, and that NACM
-denies the RPC to users outside the admin group.
+expected content, that private keys and login hashes are removed from
+the configuration in it, that the archive can be GPG encrypted, and
+that NACM denies the RPC to users outside the admin group.
 
 ==== Topology
 
@@ -15,9 +16,17 @@ image::topology.svg[Support Data Collection topology, align=center, scaledwidth=
 ==== Sequence
 
 . Set up topology and attach to target DUT
-. Collect support data with the support-collect RPC
-. Verify the archive returned by the RPC
-. Add user 'supportless', outside the admin NACM group
-. Verify user 'supportless' is denied the support-collect RPC
-. Collect an encrypted archive with the support-collect RPC
-. Decrypt the encrypted archive and verify it
+. Call the infix-system:support-collect RPC without a password
+. Base64 decode the 'data' reply to a .tar.gz file, verify its length matches the 'size' reply
+. Verify the archive holds collection.log, running-config.json, operational-config.json, system/dmesg.txt, system/meminfo.txt and network/ip/addr.json
+. Verify running-config.json in the archive has the ietf-keystore:keystore container and the admin user
+. Verify the admin user in running-config.json has no password leaf
+. Verify neither running-config.json nor operational-config.json has any password, cleartext-private-key, cleartext-symmetric-key or shared-secret leaf
+. Add user 'supportless' with password 'supportless-password', member of no NACM group
+. Verify the support-collect RPC is denied when called as 'supportless'
+. Call the support-collect RPC with password 'test-support-password-123'
+. Base64 decode the reply to a .gpg file, decrypt it with gpg and the same password
+. Verify the decrypted archive holds the same files as the first one
+. Verify the decrypted archive has the same secrets removed
+
+