• About

blog.alam.rocks

blog.alam.rocks

Category Archives: Tutorial

Python Script – Credentials stored in Hashicorp Vault

06 Saturday Jun 2020

Posted by Fakrul Alam in My Work, Tutorial

≈ Leave a comment

Tags

API Key, Hashicorp Vault, python, Python Client for Hashicorp Vault, scripting

In previous post [How to hide Password / API Key in Python Script] I have used “keyring” to store API Key for Python script. We can also use Hashicorp Vault to store those credentials. There is python module named hvac (Python Client for Hashicorp Vault) which can be used to retrieve API key/Credentials from the vault.

First we need to make sure Vault is working properly and we have our API key stored in the vault. In this example I have stored my Meraki API key:

root@lxd-home:/home/fakrul# vault kv get secret/meraki
====== Metadata ======
Key Value
--- -----
created_time 2020-06-05T15:13:18.320931138Z
deletion_time n/a
destroyed false
version 1
========== Data ==========
Key Value
--- -----
MERAKI_API_VALUE de300b8b9xxxxxxxxxxxxxxxxxxxxxxxxx40fb4391c

Now install python havc module

python3 -m pip hvac

Finally we modify our python script accordingly

import requests
import hvac

client = hvac.Client(url='http://192.168.99.252:8200')
read_response = client.secrets.kv.read_secret_version(path='meraki')

MERAKI_API_KEY = 'X-Cisco-Meraki-API-Key'
ORG_ID='123456'
MERAKI_API_VALUE = read_response['data']['data']['MERAKI_API_VALUE']

url = 'https://api.meraki.com/api/v0/organizations/{}/inventory'.format(ORG_ID)

response = requests.get(url=url,
           headers={MERAKI_API_KEY : MERAKI_API_VALUE,
                   'Content-type': 'application/json'})

switch_list = response.json()

switch_serial = []
for i in switch_list:
    if i['model'][:2] in ('MS') and i['networkId'] is not None:
    switch_serial.append(i['serial'])

print(switch_serial)

How to hide Password / API Key in Python Script

04 Thursday Jun 2020

Posted by Fakrul Alam in My Work, Tutorial

≈ 2 Comments

Tags

automation, keyring, python

It’s common to use Python script for device configuration, backup or automation. And to do that we usually put credentials, API Key in the script itself. It creates a whole lot of problem with sharing scripts with others; store/share it public repository. There are few options to overcome the issue like storing credentials, API Key’s in separate file and not share that file with others. We can also use “keyring” which will store the password in operating system’s credential store.

The keyring package is a library designed to let you access your operating system’s credential store. In summary, it let us to store and retrieve passwords in operating system, which allows you to avoid having a password in plaintext in the script.

“keyring” is by default installed in our linux operating system. We need to install related python modules only. To check keyring installation try “keyring --help” or “keyring --list-backends” for list of supported backends. The common one is to use

keyrings.cryptfile - Encrypted text file storage.

Now install the keyring and keyrings.cryptfile python module. I am using python3

pip3 install keyring
pip3 install keyrings.cryptfile

We can use keyring set command to store the credentials and keyring get command to retrieve it. Lets store some credential and API key

keyring set meraki MERAKI_API_VALUE
keyring set meraki ORG_ID

Continue reading →

cloud-init: Automatically import your public SSH keys into LXD Instances

10 Friday Jan 2020

Posted by Fakrul Alam in Education, My Work, Tutorial

≈ Leave a comment

Tags

automation, cloud-init, lxc, lxc profile, lxd, SSH, ssh-key, ubuntu, YAML

While provisioning LXD instance; we can define post deployment task using cloud-init. This will help us to import your public SSH keys, add new user, update packages and install new packages if required. To do that we use lxc profile.

First check what lxc profile you have. There should be one default profile.

# lxc profile list

Copy default profile and create new one

# lxc profile copy default production

Edit newly created profile

# lxc profile edit production

Use the following configuration. This is YAML file and for better formatting please download it from here

Continue reading →

Setup a Site to Site IPsec VPN With Strongswan & Meraki MX (IKEv1)

27 Monday May 2019

Posted by Fakrul Alam in My Work, Tutorial

≈ Leave a comment

Tags

Azure, Azure VPN Gateway, IKEv1, Meraki, Site2Site VPN, StrongSwan

Recently I am trying to build Site 2 Site IPSEC VPN with Azure VPN gateway and Meraki MX firewall. Meraki start supporting (27th May 2019) IKEv2 in their beta firmware MX 15.13 but it’s not stable.

Please check https://community.meraki.com/t5/Security-SD-WAN/Azure-VPN-IKEv2-intermittent/m-p/47688#M12029 and https://community.meraki.com/t5/Security-SD-WAN/IKEv2-support-on-MX-devices/m-p/48333#M12197

Azure Policy Based VPN gateway (IKEv1) is ok but it only suppotrs one Site 2 Site VPN tunnel.

To overcome the issue; I have created one Ubuntu Server which works as VPN gateway and added User-defined route to route all VPN traffic via Ubuntu Server.

A. Azure Configuration

1. Create a virtual machine. I my case I have created VM with Ubuntu 18.04 LTS with following specification

ipsecvpn_1.PNG

2. After creating VM go to VM > Networking > Network Interface and Enable IP forwarding settings

ipsecvpn_2.PNG

3. From NSG make sure UDP/500 and UDP/4500 has been allowed.

4. Create Route Table. 192.168.100.0/24 is the remote subnet and 10.0.0.9 is the IP address of Ubuntu Server.

ipsecvpn_3.PNG

5. Make sure you associate it with existing network/VNET

ipsecvpn_4.PNG

Continue reading →

Configure Express Route and Site-to-Site coexisting connections

04 Saturday May 2019

Posted by Fakrul Alam in My Work, Tutorial

≈ 1 Comment

Tags

Azure, Express Route, IPSEC, Meraki

 

We can now configure Express Route and Site-To-Site VPN connection that coexist. Can configure Site-to-Site VPN as a secure failover path for ExpressRoute, or use Site-to-Site VPNs to connect to sites that are not connected through ExpressRoute.

There are some limitation and restriction; for details please check:

https://docs.microsoft.com/en-us/azure/expressroute/expressroute-howto-coexist-resource-manager

In this example I already have VPN Gateway configured with /24 Gateway Subnet

 

az-1

Now will create a New VPN Gateway for IPSEC

Step 1: Get the VNET, Gateway Subnet details

$vnet = Get-AzVirtualNetwork -Name SEGResourceGroup-vnet -ResourceGroupName SEGResourceGroup
$subnet = Get-AzVirtualNetworkSubnetConfig -Name 'GatewaySubnet' -VirtualNetwork $vnet

Step 2: New Public IP address and assign it to VPN gateway

$gwpip= New-AzPublicIpAddress -Name SEG-GatewayVPNPublicIP -ResourceGroupName SEGResourceGroup -Location australiaeast -AllocationMethod Dynamic
$gwipconfig = New-AzVirtualNetworkGatewayIpConfig -Name SEG-GatewayVPNPublicIPConfig -SubnetId $subnet.Id -PublicIpAddressId $gwpip.Id

Step 3: Now create site-to-site VPN gateway

New-AzVirtualNetworkGateway -Name SEG-GatewayVPN -ResourceGroupName SEGResourceGroup -Location australiaeast -IpConfigurations $gwipconfig -GatewayType Vpn -VpnType RouteBased -GatewaySku Standard

Verify the VPN Gateway configuration. Important things to check:

GatewayType: VPN

VPNType: RouteBased

VPNClientConfiguration: IkeV2

az-2.PNG

Step 4: Create the Local Network Gateway Continue reading →

← Older posts

Social

  • View rapappu’s profile on Twitter
  • View fakrulalam’s profile on LinkedIn
  • View fakrul’s profile on GitHub
  • View FakrulAlamPappu’s profile on Google+
  • View fakrulalam’s profile on Flickr

Twitter Updates

  • #sydeny #summer https://t.co/4FhMTbgG1g 1 week ago
  • RT @protocoljournal: The August 2022 issue of IPJ is ready. Head over to protocoljournal.org for your copy! https://t.co/c0dfwBQAuu 3 weeks ago
  • RT @teamcymru: Take The first step toward clarity, visibility, and reducing external asset related risks With our free Attack Surface Asses… 3 weeks ago
  • RT @akanygren: Have you been working with tech for years and want an overview of #IPv6? I've been working on an open source "Inessential I… 1 month ago
  • blog.lastpass.com/2022/11/notice… 2 months ago
  • #bdnog15 CfP is now open bdnog.org/bdnog15/cfp.php #bdnog #bangladesh #nog #networkoperatorsgroup 2 months ago
  • RT @Cloudflare: Today we’re introducing Cloudflare Radar’s route leak data and API so that anyone can get information about route leaks acr… 2 months ago
  • Battling Zimbabwe fall short as Bangladesh win in chaotic final-over finish espncricinfo.com/series/icc-men… #t20 #worldcup #bangladeh 3 months ago
  • RT @vince2_: With the team @Free_1337, we have developed a Netflow/IPFIX collector and visualizer. It is available at https://t.co/6XtpOtm9… 6 months ago
  • RT @openbsdnow: Effective Shell effective-shell.com 7 months ago
  • RT @nocontextfooty: https://t.co/PU0JeRSrbD 7 months ago
  • smallstep.com/blog/if-openss… 7 months ago
  • github.com/tldr-pages/tldr 9 months ago
  • How to properly interpret a traceroute or MTR | APNIC Blog blog.apnic.net/2022/03/28/how… 9 months ago
  • #dayandnight #Newcastle #beachlife https://t.co/LaKATcEsFY 10 months ago
Follow @rapappu

Tags

antismap antivirus automation Azure bangladesh BASH BASH Script BDCERT bgp bind ccsp centos CentOS mirror CERT CISA cisco Cyber Security ddos dhaka dhakacom DNS DNSSEC GSM intrusion detectoin system Intrusion prevention system ips IPv6 ISACA junos linux Looking Glass lxc lxc profile lxd mailqueue mailscanner Mail Server mailwatch Meraki mikrotik monitor mpls MPLS L3 VPN mysql My Work network network management nginx NSD observium OpenVPN perl PHP ping postfix Proxy PTA python RANCID Reading RPKI Shell Script sms sms server SNMP SSH Tutorial ubuntu Ubuntu Mirror Server Virtual Box vispan vmware websvn Youtube hack খামাখা

Blog at WordPress.com.

  • Follow Following
    • blog.alam.rocks
    • Join 27 other followers
    • Already have a WordPress.com account? Log in now.
    • blog.alam.rocks
    • Customize
    • Follow Following
    • Sign up
    • Log in
    • Report this content
    • View site in Reader
    • Manage subscriptions
    • Collapse this bar
 

Loading Comments...