Security.idl
/* SPDX-License-Identifier: BSD-3-Clause */
/*
* Copyright 2009 Raritan Inc. All rights reserved.
*/
#include <UserEvent.idl>
/**
* %Security Configuration
*/
module security {
/** IP packet filter policy */
enumeration IpfwPolicy {
ACCEPT, ///< Accept the packet
DROP, ///< Silently discard the packet
REJECT ///< Discard packet, send error response
};
/** IP packet filter rule */
structure IpfwRule {
string ipMask; ///< Remote IP and network mask
IpfwPolicy policy; ///< Filter policy
};
/** IP packet filter configuration */
structure IpFw_2_0_0 {
boolean enabled; ///< \c true to enable packet filtering
IpfwPolicy defaultPolicyIn; ///< The default policy for inbound traffic in case no rule matches
IpfwPolicy defaultPolicyOut; ///< The default policy for outbound traffic in case no rule matches
vector<IpfwRule> ruleSetIn; ///< Ordered list of inbound firewall rules
vector<IpfwRule> ruleSetOut; ///< Ordered list of outbound firewall rules
};
/** Role-based access policy */
enumeration RoleAccessPolicy {
ALLOW, ///< Access granted
DENY ///< Access denied
};
/** Role-based access rule */
structure RoleAccessRule {
string startIp; ///< Start of IP range
string endIp; ///< End of IP range
int roleId; ///< Role id
RoleAccessPolicy policy; ///< Access policy
};
/** Role-based access control settings */
structure RoleAccessControl {
boolean enabled; ///< \c true to enable role-based access control
RoleAccessPolicy defaultPolicy; ///< Default policy
vector<RoleAccessRule> rules; ///< List of access rules
};
/** Password settings */
structure PasswordSettings {
boolean enableAging; ///< \c true to enable password aging
int agingInterval; ///< Aging interval in days
boolean enableStrongReq; ///< \c true to enable strong password requirements
int minPwLength; ///< Minimum password length
int maxPwLength; ///< Maximum password length
boolean enforceLower; ///< Passwords must contain at least one lower case character
boolean enforceUpper; ///< Passwords must contain at least one upper case character
boolean enforceNumeric; ///< Passwords must contain at least one numeric character
boolean enforceSpecial; ///< Passwords must contain at least one special character
int pwHistoryDepth; ///< Number of entries in password history
};
/** SSH authentication settings */
structure SSHSettings {
boolean allowPasswordAuth; ///< Allow password authentication
boolean allowPublicKeyAuth; ///< Allow public key authentication
};
/** Type of SSH host key */
enumeration SSHHostKeyType {
SSH_HOST_KEY_TYPE_RSA,
SSH_HOST_KEY_TYPE_ECDSA
};
/** Type of SSH key fingerprint */
enumeration SSHKeyFingerprintType {
SSH_KEY_FPRINT_TYPE_MD5_HEX,
SSH_KEY_FPRINT_TYPE_SHA256_BASE64,
SSH_KEY_FPRINT_TYPE_UNKNOWN
};
/** Fingerprints of SSH host key */
structure SSHKeyFingerprint {
string fingerprint; ///< Fingerprint of SSH key
SSHKeyFingerprintType type; ///< Type of fingerprint
};
/** SSH host keys */
structure SSHHostKey {
string key; ///< Public key
SSHHostKeyType type; ///< Type of public key
vector<SSHKeyFingerprint> fingerprints; ///< Fingerprints of public key
};
/** Restricted Service Agreement settings */
structure RestrictedServiceAgreement {
boolean enabled; ///< Enforce Restricted Service Agreement
string banner; ///< Restricted Service Agreement Banner
};
/**
* This Event is emitted after any of the password-settings
* has been changed
*/
valueobject PasswordSettingsChanged extends event.UserEvent {
PasswordSettings oldSettings;
PasswordSettings newSettings;
};
/**
* Front panel privileges have been changed
*/
valueobject FrontPanelPrivilegesChanged extends event.UserEvent {
vector<string> oldPrivileges; ///< old front panel privileges
vector<string> newPrivileges; ///< new front panel privileges
};
/** %Security configuration interface */
interface Security_3_0_2 {
constant int ERR_INVALID_VALUE = 1; ///< Invalid arguments
/** %Security configuration
* This structure is deprecated and will be removed in V3.0,
* use concrete getters and setters instead!
*/
structure Settings {
boolean http2httpsRedir; ///< \c true to enable HTTP-to-HTTPS redirection
int userBlockTimeout; ///< User blocking timeout in minutes
int userMaxFailedLogins; ///< Maximum number of failed logins before blocking a user
IpFw_2_0_0 ipFw; ///< IP packet filter configuration
IpFw_2_0_0 ipV6Fw; ///< IPv6 packet filter configuration
RoleAccessControl roleAccessControl; ///< Role-based access control settings
RoleAccessControl roleAccessControlV6; ///< Role-based access control settings for IPv6
PasswordSettings pwSettings; ///< Password settings
int idleTimeout; ///< Session idle timeout in minutes
boolean singleLogin; ///< \c true to enable single login limitation
SSHSettings sshSettings; ///< SSH authentication settings
};
/**
* Retrieve the security configuration.
* This method is depreacted and will be removed in V3.0,
* use concrete getter instead!
*
* @return %Security configuration
*/
[deprecated]
Settings getSettings();
/**
* Set the security configuration.
* This method is depreacted and will be removed in V3.0,
* use concrete setter instead!
*
* @param settings New security settings
*
* @return 0 on success
* @return ERR_INVALID_VALUE if any argument was invalid
*/
[deprecated]
int setSettings(in Settings settings);
/**
* Retrieve the current state of the HTTP-to-HTTPS redirection.
*
* @return \c true if the HTTP-to-HTTPS redirection is enabled
*/
boolean getHttpRedirSettings();
/**
* Enable or disable HTTP-to-HTTPS redirection.
*
* @param http2httpsRedir \c true to enable the redirection
*/
void setHttpRedirSettings(in boolean http2httpsRedir);
/**
* Check whether HTTP Strict Transport Security (HSTS) is enabled
*
* @return \c true when HSTS is enabled
*/
boolean isHstsEnabled();
/**
* Enable or disable HTTP Strict Transport Security (HSTS).
*
* @param enable \c true to enable HSTS
*/
void setHstsEnabled(in boolean enable);
/**
* Retrieve the IPv4 packet filter configuration.
*
* @return %IPv4 packet filter configuration
*/
IpFw_2_0_0 getIpFwSettings();
/**
* Set the IPv4 packet filter configuration.
*
* @param ipFw New packet filter settings
*
* @return 0 on success
* @return ERR_INVALID_VALUE if any argument was invalid
*/
int setIpFwSettings(in IpFw_2_0_0 ipFw);
/**
* Retrieve the IPv6 packet filter configuration.
*
* @return %IPv6 packet filter configuration
*/
IpFw_2_0_0 getIpV6FwSettings();
/**
* Set the IPv6 packet filter configuration.
*
* @param ipV6Fw New packet filter settings
*
* @return 0 on success
* @return ERR_INVALID_VALUE if any argument was invalid
*/
int setIpV6FwSettings(in IpFw_2_0_0 ipV6Fw);
/**
* Retrieve the role-base access control settings for IPv4.
*
* @return Role-based access control settings
*/
RoleAccessControl getRoleAccessControlSettings();
/**
* Change the role-based access control settings.
*
* @param settings New settings
*
* @return 0 on success
* @return ERR_INVALID_VALUE if any argument was invalid
*/
int setRoleAccessControlSettings(in RoleAccessControl settings);
/**
* Retrieve the role-base access control settings for IPv6.
*
* @return Role-based access control settings
*/
RoleAccessControl getRoleAccessControlSettingsV6();
/**
* Change the role-based access control settings for IPv6.
*
* @param settings New settings
*
* @return 0 on success
* @return ERR_INVALID_VALUE if any argument was invalid
*/
int setRoleAccessControlSettingsV6(in RoleAccessControl settings);
/**
* Retrieve the current user blocking settings
*
* @return blockTimeout The block timeout in minutes
* @return maxFailedLogins The maximum failure count
*/
void getBlockSettings(out int blockTimeout, out int maxFailedLogins);
/**
* Change the user blocking settings.
*
* @param blockTimeout User blocking timeout in minutes
* @param maxFailedLogins Maximum number of failed logins
*
* @return 0 on success
* @return ERR_INVALID_VALUE if any argument was invalid
*/
int setBlockSettings(in int blockTimeout, in int maxFailedLogins);
/**
* Retrieve the password settings.
*
* @return Password settings
*/
PasswordSettings getPwSettings();
/**
* Change the password settings.
*
* @param pwSettings New settings
*
* @return 0 on success
* @return ERR_INVALID_VALUE if any argument was invalid
*/
int setPwSettings(in PasswordSettings pwSettings);
/**
* Retrieve the current idle timeout.
*
* @return Idle timeout in minutes
*/
int getIdleTimeoutSettings();
/**
* Change the session idle timeout.
*
* @param idleTimeout New idle timeout in minutes
*
* @return 0 on success
* @return ERR_INVALID_VALUE if any argument was invalid
*/
int setIdleTimeoutSettings(in int idleTimeout);
/**
* Retrieve the current single-login limitation setting.
*
* @return \c true if single-login limitation is enabled
*/
boolean getSingleLoginLimitation();
/**
* Enable or disable single login limitation.
*
* @param singleLogin \c true to enable single login limitation
*/
void setSingleLoginLimitation(in boolean singleLogin);
/**
* Retrieve the current SSH settings
*
* @return SSH settings
*/
SSHSettings getSSHSettings();
/**
* Change the SSH settings
*
* @param settings New settings
*/
void setSSHSettings(in SSHSettings settings);
/**
* Retrieve the host SSH keys
*
* @return SSH host keys
*/
vector<SSHHostKey> getSSHHostKeys();
/**
* Retrieve the current Restricted Service Agreement settings
*
* @return Restricted Service Agreement settings
*/
RestrictedServiceAgreement getRestrictedServiceAgreement();
/**
* Change the Restricted Service Agreement settings
*
* @param settings New settings
*
* @return 0 on success
* @return ERR_INVALID_VALUE if any argument was invalid
*/
int setRestrictedServiceAgreement(in RestrictedServiceAgreement settings);
/**
* Retrieve a list of supported privileges for the front panel
*
* @return List of privilege names
*/
vector<string> getSupportedFrontPanelPrivileges();
/**
* Retrieve the list of active front panel privileges
*
* @return List of privilege names
*/
vector<string> getFrontPanelPrivileges();
/**
* Set the privileges for the front panel
*
* @return 0 on success
* @return ERR_INVALID_VALUE if any argument was invalid
*/
int setFrontPanelPrivileges(in vector<string> privileges);
};
}
security::RoleAccessRule::roleId
int roleId
Role id.
Definition: Security.idl:45
security::PasswordSettings::maxPwLength
int maxPwLength
Maximum password length.
Definition: Security.idl:62
security::SSHHostKey
SSH host keys.
Definition: Security.idl:96
security::IpfwRule
IP packet filter rule.
Definition: Security.idl:21
security::SSHKeyFingerprint
Fingerprints of SSH host key.
Definition: Security.idl:90
security::IpfwRule::ipMask
string ipMask
Remote IP and network mask.
Definition: Security.idl:22
security::RoleAccessControl::enabled
boolean enabled
true to enable role-based access control
Definition: Security.idl:51
security::PasswordSettings::enableStrongReq
boolean enableStrongReq
true to enable strong password requirements
Definition: Security.idl:60
security::RoleAccessRule::endIp
string endIp
End of IP range.
Definition: Security.idl:44
security::RoleAccessRule
Role-based access rule.
Definition: Security.idl:42
security::PasswordSettings
Password settings.
Definition: Security.idl:57
security::SSHKeyFingerprint::type
SSHKeyFingerprintType type
Type of fingerprint.
Definition: Security.idl:92
security::SSHKeyFingerprint::fingerprint
string fingerprint
Fingerprint of SSH key.
Definition: Security.idl:91
security::IpFw_2_0_0
IP packet filter configuration.
Definition: Security.idl:27
security::SSHHostKeyType
SSHHostKeyType
Type of SSH host key.
Definition: Security.idl:77
security::IpfwPolicy
IpfwPolicy
IP packet filter policy.
Definition: Security.idl:14
security::PasswordSettings::enforceNumeric
boolean enforceNumeric
Passwords must contain at least one numeric character.
Definition: Security.idl:65
security::SSHHostKey::fingerprints
vector< SSHKeyFingerprint > fingerprints
Fingerprints of public key.
Definition: Security.idl:99
security::Security_3_0_2::Settings::idleTimeout
int idleTimeout
Session idle timeout in minutes.
Definition: Security.idl:143
security::PasswordSettingsChanged
valueobject PasswordSettingsChanged
This Event is emitted after any of the password-settings has been changed.
Definition: Security.idl:113
security::DENY
Access denied.
Definition: Security.idl:38
security::Security_3_0_2::Settings::pwSettings
PasswordSettings pwSettings
Password settings.
Definition: Security.idl:142
security::ACCEPT
Accept the packet.
Definition: Security.idl:15
security::Security_3_0_2::Settings::roleAccessControlV6
RoleAccessControl roleAccessControlV6
Role-based access control settings for IPv6.
Definition: Security.idl:141
security::Security_3_0_2::Settings::sshSettings
SSHSettings sshSettings
SSH authentication settings.
Definition: Security.idl:145
security::Security_3_0_2::Settings
Security configuration This structure is deprecated and will be removed in V3.0, use concrete getters...
Definition: Security.idl:134
security::Security_3_0_2::Settings::roleAccessControl
RoleAccessControl roleAccessControl
Role-based access control settings.
Definition: Security.idl:140
security::PasswordSettings::minPwLength
int minPwLength
Minimum password length.
Definition: Security.idl:61
security::RoleAccessPolicy
RoleAccessPolicy
Role-based access policy.
Definition: Security.idl:36
security::PasswordSettings::enforceSpecial
boolean enforceSpecial
Passwords must contain at least one special character.
Definition: Security.idl:66
security::PasswordSettings::agingInterval
int agingInterval
Aging interval in days.
Definition: Security.idl:59
security::RestrictedServiceAgreement::enabled
boolean enabled
Enforce Restricted Service Agreement.
Definition: Security.idl:104
security::Security_3_0_2::Settings::userBlockTimeout
int userBlockTimeout
User blocking timeout in minutes.
Definition: Security.idl:136
security::Security_3_0_2::Settings::http2httpsRedir
boolean http2httpsRedir
true to enable HTTP-to-HTTPS redirection
Definition: Security.idl:135
security::RoleAccessControl::rules
vector< RoleAccessRule > rules
List of access rules.
Definition: Security.idl:53
security::RoleAccessRule::startIp
string startIp
Start of IP range.
Definition: Security.idl:43
security::ALLOW
Access granted.
Definition: Security.idl:37
security::IpFw_2_0_0::defaultPolicyOut
IpfwPolicy defaultPolicyOut
The default policy for outbound traffic in case no rule matches.
Definition: Security.idl:30
security::SSHKeyFingerprintType
SSHKeyFingerprintType
Type of SSH key fingerprint.
Definition: Security.idl:83
security::PasswordSettings::enableAging
boolean enableAging
true to enable password aging
Definition: Security.idl:58
security::RoleAccessControl
Role-based access control settings.
Definition: Security.idl:50
security::SSHSettings::allowPasswordAuth
boolean allowPasswordAuth
Allow password authentication.
Definition: Security.idl:72
security::SSHSettings::allowPublicKeyAuth
boolean allowPublicKeyAuth
Allow public key authentication.
Definition: Security.idl:73
security::IpfwRule::policy
IpfwPolicy policy
Filter policy.
Definition: Security.idl:23
security::SSHHostKey::type
SSHHostKeyType type
Type of public key.
Definition: Security.idl:98
security::SSHHostKey::key
string key
Public key.
Definition: Security.idl:97
security::IpFw_2_0_0::defaultPolicyIn
IpfwPolicy defaultPolicyIn
The default policy for inbound traffic in case no rule matches.
Definition: Security.idl:29
security::REJECT
Discard packet, send error response.
Definition: Security.idl:17
security::RoleAccessControl::defaultPolicy
RoleAccessPolicy defaultPolicy
Default policy.
Definition: Security.idl:52
security::PasswordSettings::enforceUpper
boolean enforceUpper
Passwords must contain at least one upper case character.
Definition: Security.idl:64
security::PasswordSettings::enforceLower
boolean enforceLower
Passwords must contain at least one lower case character.
Definition: Security.idl:63
security::RestrictedServiceAgreement::banner
string banner
Restricted Service Agreement Banner.
Definition: Security.idl:105
security::IpFw_2_0_0::ruleSetOut
vector< IpfwRule > ruleSetOut
Ordered list of outbound firewall rules.
Definition: Security.idl:32
security::SSHSettings
SSH authentication settings.
Definition: Security.idl:71
security::RestrictedServiceAgreement
Restricted Service Agreement settings.
Definition: Security.idl:103
security::newPrivileges
vector< string > newPrivileges
new front panel privileges
Definition: Security.idl:122
security::Security_3_0_2
Security configuration interface
Definition: Security.idl:126
security::DROP
Silently discard the packet.
Definition: Security.idl:16
security::Security_3_0_2::Settings::ipFw
IpFw_2_0_0 ipFw
IP packet filter configuration.
Definition: Security.idl:138
security::Security_3_0_2::Settings::ipV6Fw
IpFw_2_0_0 ipV6Fw
IPv6 packet filter configuration.
Definition: Security.idl:139
security::IpFw_2_0_0::enabled
boolean enabled
true to enable packet filtering
Definition: Security.idl:28
security::IpFw_2_0_0::ruleSetIn
vector< IpfwRule > ruleSetIn
Ordered list of inbound firewall rules.
Definition: Security.idl:31
security
Security Configuration
Definition: Security.idl:11
security::PasswordSettings::pwHistoryDepth
int pwHistoryDepth
Number of entries in password history.
Definition: Security.idl:67
security::Security_3_0_2::Settings::singleLogin
boolean singleLogin
true to enable single login limitation
Definition: Security.idl:144
security::Security_3_0_2::Settings::userMaxFailedLogins
int userMaxFailedLogins
Maximum number of failed logins before blocking a user.
Definition: Security.idl:137
security::RoleAccessRule::policy
RoleAccessPolicy policy
Access policy.
Definition: Security.idl:46