Read-only sources

The short answer

• Sources only read. When a source loads, Devexana rejects it if it declares a write operation.
• Each read function needs approval. Each read function stays off until an administrator approves it.
• Switch commands pass an allowlist. Devexana sends a switch only commands that pass a read-only command allowlist.
• Network-device changes are locked. In this release, changes to network-device configuration are disabled in code.
• Sources need read access only. Give each source a read-only account. Do not give a source account permission to change configuration.
• Business-system writes are separate. The What can write table lists the business-system writes and their defaults. None of them can change network-device configuration.

Access that Devexana needs

Create read-only accounts gives the steps for each account. Devexana stores each credential encrypted on the appliance.

Checks on the read path

Each type of source has its own guard. Devexana checks API source declarations and requires administrator approval for each read function. Switch and firewall reads over SSH and SNMP pass the command guard for their transport. Directory sources use a read-only bind. A read that fails a check does not leave the appliance.

1. Each source must declare itself read-only when it loads (API sources). Devexana rejects a source that declares any HTTP method other than GET, HEAD or OPTIONS. It also rejects a read function whose name contains a write verb.
2. An administrator approves each read function (API sources). Every read function starts off. An administrator approves the read functions in the last step of adding a source, or later on the source's page. Devexana records the approval in the audit log. The approval path cannot approve a write. Switch, firewall SSH, directory and DHCP lease file sources have no read functions to approve. An administrator adds the source, and the guard for its transport limits what it reads.
3. Devexana checks each command (switch and firewall reads). Devexana checks each command before it leaves the appliance. Each transport has its own guard. The next section lists what each guard allows.

The NetBox and Nautobot readers follow the same rule. They reject write attributes when they load, and they are off by default.

What each transport allows

Devexana sends a switch only commands that start with a read verb such as show, display or get. It refuses shell metacharacters, so a read command cannot be chained to another command.

What is recorded

Devexana records device commands in two places.

Devexana also protects the data it reads:

• It masks secrets in device output before it stores the output. This covers RADIUS and TACACS+ keys, SNMP communities, password hashes and private keys.
• It records the SSH host key of each network device at the first connection. Later, it refuses a different host key.

What Devexana reads by default

By default, Devexana reads each switch's running configuration once a day. A wider set of read commands is an installation setting. Switches over SSH and SNMP lists the commands.

Restrict the device account too

Restrict the device account as well as the commands. Configure both controls.

1. Give Devexana a dedicated account on each network device. Create read-only accounts gives the steps.
2. Give that account a read-only role on the network device.
3. On Linux-based network equipment, limit the files that the account can open.
4. Use an SNMP read-only community or an SNMPv3 read-only user.

Listeners

Listeners receive syslog, SNMP traps and NetFlow. The listener sockets cannot send.

The device-change lock

In this release, a lock in the code refuses every network-device change before any connection to the device opens. No setting or approval releases it. Devexana records each refusal in the audit log.

The lock covers:

• Changes to switches and routers.
• Changes to firewalls, network access control, cloud-managed networks and voice systems.
• The interactive SSH terminal.
• The serial console.

Change proposals and human approval describes the change-approval design behind the lock.

What can write

This table lists the write paths in Devexana and the default of each. In this release, none of them can change network-device configuration.

The device-change lock does not cover the business-system writes in this table. Their own settings and approvals control them.

Limits

Supported vendors and protocols gives the support tier for each vendor. Outbound connections: the complete list lists the outbound connections and their defaults.