<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p>Brian,</p>
<p><br>
</p>
<p>We're still okay there. Cisco hasn't changed the algorithm used to store passwords in platformConfig.xml, so the UCOS Password Decrypter still works.</p>
<p><br>
</p>
<p>I know you're familiar with this next part, but I'll include it for the public. When backups are generated, the encrypted security password is copied directly from platformConfig.xml and hashed. The results of that hash are used as a key to encrypt the
random backup password which then gets stuffed into the backup set XML. The algorithm used for the hash in this process is what they changed.</p>
<p><br>
</p>
<p>One option would be to roll the UCOS Password Decrypter functions into the new command line Java app. That way you could run it directly on a rooted UCOS VM to dump the platformConfig.xml passwords.</p>
<p><br>
</p>
<p>Thanks,</p>
<p>Pete</p>
<br>
<br>
<div style="color: rgb(0, 0, 0);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> bmeade90@gmail.com <bmeade90@gmail.com> on behalf of Brian Meade <bmeade90@vt.edu><br>
<b>Sent:</b> Wednesday, September 27, 2017 10:10 AM<br>
<b>To:</b> Pete Brown<br>
<b>Cc:</b> Anthony Holloway; cisco-voip@puck.nether.net<br>
<b>Subject:</b> Re: [cisco-voip] DRS Backup Decrypter Workaround - Need Input</font>
<div> </div>
</div>
<div>
<div dir="ltr">Pete,
<div><br>
</div>
<div>I'm assuming we won't be able to decrypt the password from the platformConfig.xml anymore?</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Brian</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Wed, Sep 27, 2017 at 11:01 AM, Pete Brown <span dir="ltr">
<<a href="mailto:jpb@chykn.com" target="_blank">jpb@chykn.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="ltr">
<div id="m_2956096658433299671divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Helvetica,sans-serif">
<p>Thanks for the feedback everyone, I really appreciate it.</p>
<p><br>
</p>
<p>Anthony - Great idea, will keep that one in mind.</p>
<p><br>
</p>
<p>Brian - You mentioned using it to verify the cluster security passwords on backups. Given that the workaround has changed from a webservice to a local Java app, the Java app could be used via command line under Windows and Linux. Maybe have a switch on
it to verify the password for a backup set. Feed it the cluster security password and backup set location and it will kick back a pass or fail. That way you could do one off checks or run nightly scripts to make sure the cluster security passwords for your
backups haven't changed.</p>
<p></p>
<br>
<br>
<div style="color:rgb(0,0,0)">
<hr style="display:inline-block; width:98%">
<div id="m_2956096658433299671divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b>
<a href="mailto:bmeade90@gmail.com" target="_blank">bmeade90@gmail.com</a> <<a href="mailto:bmeade90@gmail.com" target="_blank">bmeade90@gmail.com</a>> on behalf of Brian Meade <<a href="mailto:bmeade90@vt.edu" target="_blank">bmeade90@vt.edu</a>><br>
<b>Sent:</b> Tuesday, September 26, 2017 3:51 PM<br>
<b>To:</b> Anthony Holloway<br>
<b>Cc:</b> Pete Brown; <a href="mailto:cisco-voip@puck.nether.net" target="_blank">
cisco-voip@puck.nether.net</a><span class=""><br>
<b>Subject:</b> Re: [cisco-voip] DRS Backup Decrypter Workaround - Need Input</span></font>
<div> </div>
</div>
<div>
<div class="h5">
<div>
<div dir="ltr">
<div>Definitely a good tip.</div>
<div><br>
</div>
That does assume you can guess the password. I've had a bunch of customers have some random cluster security password they had never heard of.</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Tue, Sep 26, 2017 at 4:24 PM, Anthony Holloway <span dir="ltr">
<<a href="mailto:avholloway+cisco-voip@gmail.com" target="_blank">avholloway+cisco-voip@gmail.<wbr>com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="ltr">There's an easier (IMO) way to check cluster security passwords.
<div><br>
</div>
<div>1) Enter the change password CLI command, and enter the password you have</div>
<div><br>
</div>
<div><span style="white-space:pre-wrap"><font face="monospace"></font></span><font face="monospace">admin:set password user security</font></div>
<div><span style="white-space:pre-wrap"><font face="monospace"></font></span><font face="monospace">Please enter the old password: My$3cuR1tyW0rd1</font></div>
<div><br>
</div>
<div>2) Enter the new password as a dictionary word (I like to use banana):</div>
<div><br>
</div>
<div><span style="white-space:pre-wrap"><font face="monospace"></font></span><font face="monospace"> Please enter the new password: banana</font></div>
<div><span style="white-space:pre-wrap"><font face="monospace"></font></span><font face="monospace">Reenter new password to confirm: banana</font></div>
<div><br>
</div>
<div>3) Say yes to the big scary warning:</div>
<div><br>
</div>
<div><span style="white-space:pre-wrap"><font face="monospace"></font></span><font face="monospace">WARNING:</font></div>
<div><span style="white-space:pre-wrap"><font face="monospace"></font></span><font face="monospace">You're handing in your resignation letter at 2:00pm today. Cool?</font></div>
<div><font face="monospace"><span style="white-space:pre-wrap"></span><br>
</font></div>
<div><span style="white-space:pre-wrap"><font face="monospace"></font></span><font face="monospace">Continue (y/n)? y</font></div>
<div><br>
</div>
<div>4) Get nervous for a minute and second guess your choice to follow some sketchy advice from some stranger online</div>
<div><br>
</div>
<div><span style="white-space:pre-wrap"><font face="monospace"></font></span><font face="monospace">Please wait...</font></div>
<div><br>
</div>
<div>5) Observe the outcome</div>
<div><br>
</div>
<div><span style="white-space:pre-wrap"></span>One of two things will now have happened:</div>
<div><span style="white-space:pre-wrap"></span><br>
</div>
<div><span style="white-space:pre-wrap"></span>1) "The old password did not match." This means that you do not have the cluster security password correct, and you can try again with some other guesses.</div>
<div><span style="white-space:pre-wrap"></span>2) "BAD PASSWORD: it does not contain enough DIFFERENT characters" This means that your password was correct, and the "banana" you fed it was rotten.</div>
<div><br>
</div>
<div>There you go. No need to have 3rd party software (not counting an SSH client) to help you anymore.
<div>
<div class="m_2956096658433299671h5"><br>
<br>
<div class="gmail_quote">
<div dir="ltr">On Tue, Sep 26, 2017 at 9:43 AM Brian Meade <<a href="mailto:bmeade90@vt.edu" target="_blank">bmeade90@vt.edu</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="ltr">I'd probably use it less. Right now, I use it for almost every project to verify cluster security passwords.
<div><br>
</div>
<div>I'd probably have to make this more of a last resort in that case and make sure to get sign-off from the customer.</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Tue, Sep 26, 2017 at 10:38 AM, Pete Brown <span dir="ltr">
<<a href="mailto:jpb@chykn.com" target="_blank">jpb@chykn.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="ltr">
<div id="m_2956096658433299671m_9138209788837042090m_-7561474034293236078m_-4474815288587939613divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Helvetica,sans-serif">
I could use some public input regarding the next release of the DRS Backup Decrypter. In a nutshell, the application will have to be online in order to decrypt backup sets from newer UCOS versions.
<div><br>
</div>
<div>Last year Cisco started patching DRS with a new algorithm (<span>PBEWithHmacSHA1AndDESede</span>) to encrypt the random backup passwords. I haven't been able to find a .NET implementation of this algorithm. The only workaround I've come up with is to
have the DRS Backup Decrypter make a call to a Java webservice that can perform the decryption.</div>
<div><br>
</div>
<div>The problems with this approach are pretty obvious. Aside from having to be online, the encrypted cluster security password and 'EncryptKey' from a backup set will need to be submitted to a web service that I've written for decryption. I can publish
a public copy of this webservice, but for those behind corporate proxies (myself included), the code could be made available to run the service within their own networks. In that case the DRS Backup Decrypter would be pointed to the internal copy of the webservice.</div>
<div><br>
</div>
<div>I personally detest utilities that can't operate offline, but it's the only workaround I can come up with at this point. So my question is this - would anyone actually use it given the webservice dependency?</div>
</div>
</div>
<br>
______________________________<wbr>_________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" rel="noreferrer" target="_blank">https://puck.nether.net/mailma<wbr>n/listinfo/cisco-voip</a><br>
<br>
</blockquote>
</div>
<br>
</div>
______________________________<wbr>_________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" rel="noreferrer" target="_blank">https://puck.nether.net/mailma<wbr>n/listinfo/cisco-voip</a><br>
</blockquote>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
</body>
</html>