{"id":1399,"date":"2019-08-12T11:21:28","date_gmt":"2019-08-12T16:21:28","guid":{"rendered":"http:\/\/blog.ls-al.com\/?p=1399"},"modified":"2019-08-12T11:21:29","modified_gmt":"2019-08-12T16:21:29","slug":"ships-password-rotation","status":"publish","type":"post","link":"https:\/\/blog.ls-al.com\/ships-password-rotation\/","title":{"rendered":"SHIPS Password Rotation"},"content":{"rendered":"\n<p>As explained on the website \"<em>unique and rotated local super user or administrator passwords for environments where it is not possible or not appropriate to disable these local accounts<\/em>\".<\/p>\n\n\n\n<p>I tested as a proof of concept how to: <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>setup a SHIPS server on CentOS7<\/li><li>configure SHIPS folder and ACL's for devices <\/li><li>linux client execute SetAdminPass.sh for password rotation<\/li><\/ul>\n\n\n\n<p>Note that I simplified this test so the following was true:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>no LDAP enabled for user logins into web interface (no identLDAP.rb)<\/li><li>devices not tested as belonging to LDAP OU (only using lib devicevalidatorany.rb)<\/li><li>Used ansible as much as possible to prepare the SHIPS server<\/li><li>Self signed certificate means client SetAdminPassword need --insecure with curl to even work.<\/li><li>Did not try and autostart SHIPS code on server reboot<\/li><\/ul>\n\n\n\n<p class=\"has-text-color has-vivid-red-color\">So suffice to say you were warned this is not secure and correct way to run SHIPS it is a way to test the basics!<\/p>\n\n\n\n<p class=\"has-medium-font-size\"><strong>Final run after Ansible ironed out like this:<\/strong><\/p>\n\n\n\n<p><a href=\"http:\/\/blog.ls-al.com\/wp-content\/uploads\/2019\/08\/ships-ansible.zip\">Download and unzip my file<\/a> containing ansible playbook ships.yml plus the conf, ships.cert and ships.key files in \/usr\/src\/ships-playbook.  Update the conf file with correct IP address.<\/p>\n\n\n\n<p><\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n# yum install ansible -y\n# cd \/usr\/src\/ships-playbook\/\nroot@ships ships-playbook]# rm -rf \/opt\/SHIPS ; ansible-playbook ships.yml\n\n# cd \/opt\/SHIPS\n&#x5B;root@ships SHIPS]# ruby -r .\/lib\/identsqlite -r .\/lib\/identdevice -r .\/lib\/devicevalidatorany SHIPS.rb\n<\/pre><\/div>\n\n\n<ul class=\"wp-block-list\"><li><em>from above ansible output capture password for SHIPS administrator user named root.  Visit https:\/\/ip.addr.ess and login with root user and above password.<\/em><\/li><li>for folder and ACL configuration watch the section in the video located here https:\/\/www.trustedsec.com\/2016\/03\/ships-version-2-released-major-release\/<\/li><li>I made some changes on the client SetAdminPass.sh script as shown below.<\/li><\/ul>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\nURL=&#039;https:\/\/192.168.1.98\/password&#039;\n#URL_OPTS=&quot;&quot;\n\n#RESPONSE=$( curl $CURL_OPTS -s &quot;$URL?$URL_OPTSname=$HOST&amp;nonce=$NONCE&quot; )\nRESPONSE=$( curl $CURL_OPTS -s &quot;$URL?name=$HOST&amp;nonce=$NONCE&quot; )\n\n#CURL_OPTS=&#039;&#039;\nCURL_OPTS=&#039;--insecure &#039; #DON&#039;T DO THIS!\n\nHISTORY=&#039;\/var\/run\/SHIPS.HIST&#039;\n<\/pre><\/div>\n\n\n<p><strong>LINKS:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li> https:\/\/github.com\/trustedsec\/SHIPS\/ <\/li><li>https:\/\/www.trustedsec.com\/2016\/03\/ships-version-2-released-major-release\/<\/li><li>https:\/\/github.com\/trustedsec\/SHIPS\/blob\/master\/doc\/SHIPS_Installation_v2.pdf<\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>As explained on the website &#8220;unique and rotated local super user or administrator passwords for environments where it is not<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[110],"tags":[],"class_list":["post-1399","post","type-post","status-publish","format-standard","hentry","category-ships"],"_links":{"self":[{"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/posts\/1399","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/comments?post=1399"}],"version-history":[{"count":0,"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/posts\/1399\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/media?parent=1399"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/categories?post=1399"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/tags?post=1399"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}