Loading...
Searching...
No Matches
Security.idl
/* SPDX-License-Identifier: BSD-3-Clause */
/*
* Copyright 2009 Raritan Inc. All rights reserved.
*/
#include <UserEvent.idl>
/**
* %Security Configuration
*/
module security {
/** IP packet filter policy */
enumeration IpfwPolicy {
ACCEPT, ///< Accept the packet
DROP, ///< Silently discard the packet
REJECT ///< Discard packet, send error response
};
/** IP packet filter rule */
structure IpfwRule {
string ipMask; ///< Remote IP and network mask
IpfwPolicy policy; ///< Filter policy
};
/** IP packet filter configuration */
structure IpFw {
boolean enabled; ///< \c true to enable packet filtering
IpfwPolicy defaultPolicyIn; ///< The default policy for inbound traffic in case no rule matches
IpfwPolicy defaultPolicyOut; ///< The default policy for outbound traffic in case no rule matches
vector<IpfwRule> ruleSetIn; ///< Ordered list of inbound firewall rules
vector<IpfwRule> ruleSetOut; ///< Ordered list of outbound firewall rules
};
/** Role-based access policy */
enumeration RoleAccessPolicy {
ALLOW, ///< Access granted
DENY ///< Access denied
};
/** Role-based access rule */
structure RoleAccessRule {
string startIp; ///< Start of IP range
string endIp; ///< End of IP range
int roleId; ///< Role id
RoleAccessPolicy policy; ///< Access policy
};
/** Role-based access control settings */
structure RoleAccessControl {
boolean enabled; ///< \c true to enable role-based access control
RoleAccessPolicy defaultPolicy; ///< Default policy
vector<RoleAccessRule> rules; ///< List of access rules
};
/** User blocking settings */
structure BlockSettings {
int maxFailedLogins; ///< The number of failed logins before blocking a user
int blockTimeout; ///< Time (in minutes) the account will be blocked
int failedLoginTimeout; ///< Time (in minutes) before resetting the failure counter
};
/** Password settings */
structure PasswordSettings {
boolean enableAging; ///< \c true to enable password aging
int agingInterval; ///< Aging interval in days
boolean enableStrongReq; ///< \c true to enable strong password requirements
int minPwLength; ///< Minimum password length
int maxPwLength; ///< Maximum password length
boolean enforceLower; ///< Passwords must contain at least one lower case character
boolean enforceUpper; ///< Passwords must contain at least one upper case character
boolean enforceNumeric; ///< Passwords must contain at least one numeric character
boolean enforceSpecial; ///< Passwords must contain at least one special character
int pwHistoryDepth; ///< Number of entries in password history
};
/** SSH authentication settings */
structure SSHSettings {
boolean allowPasswordAuth; ///< Allow password authentication
boolean allowPublicKeyAuth; ///< Allow public key authentication
};
/** Type of SSH host key */
enumeration SSHHostKeyType {
SSH_HOST_KEY_TYPE_RSA,
SSH_HOST_KEY_TYPE_ECDSA,
SSH_HOST_KEY_TYPE_ED25519
};
/** Type of SSH key fingerprint */
enumeration SSHKeyFingerprintType {
SSH_KEY_FPRINT_TYPE_MD5_HEX,
SSH_KEY_FPRINT_TYPE_SHA256_BASE64,
SSH_KEY_FPRINT_TYPE_UNKNOWN
};
/** Fingerprints of SSH host key */
structure SSHKeyFingerprint {
string fingerprint; ///< Fingerprint of SSH key
SSHKeyFingerprintType type; ///< Type of fingerprint
};
/** SSH host keys */
structure SSHHostKey {
string key; ///< Public key
SSHHostKeyType type; ///< Type of public key
vector<SSHKeyFingerprint> fingerprints; ///< Fingerprints of public key
};
/** Restricted Service Agreement settings */
structure RestrictedServiceAgreement {
boolean enabled; ///< Enforce Restricted Service Agreement
string banner; ///< Restricted Service Agreement Banner
};
/** Information about Trusted Platform Module */
structure TpmInfo {
boolean detected;
};
/**
* This Event is emitted after any of the password-settings
* has been changed
*/
valueobject PasswordSettingsChanged extends event.UserEvent {
PasswordSettings oldSettings;
PasswordSettings newSettings;
};
/**
* Front panel privileges have been changed
*/
valueobject FrontPanelPrivilegesChanged extends event.UserEvent {
vector<string> oldPrivileges; ///< old front panel privileges
vector<string> newPrivileges; ///< new front panel privileges
};
/** %Security configuration interface */
interface Security {
constant int ERR_INVALID_VALUE = 1; ///< Invalid arguments
/**
* Retrieve the current state of the HTTP-to-HTTPS redirection.
*
* @return \c true if the HTTP-to-HTTPS redirection is enabled
*/
boolean getHttpRedirSettings();
/**
* Enable or disable HTTP-to-HTTPS redirection.
*
* @param http2httpsRedir \c true to enable the redirection
*/
void setHttpRedirSettings(in boolean http2httpsRedir);
/**
* Check whether HTTP Strict Transport Security (HSTS) is enabled
*
* @return \c true when HSTS is enabled
*/
boolean isHstsEnabled();
/**
* Enable or disable HTTP Strict Transport Security (HSTS).
*
* @param enable \c true to enable HSTS
*/
void setHstsEnabled(in boolean enable);
/**
* Retrieve the IPv4 packet filter configuration.
*
* @return %IPv4 packet filter configuration
*/
IpFw getIpFwSettings();
/**
* Set the IPv4 packet filter configuration.
*
* @param ipFw New packet filter settings
*
* @return 0 on success
* @return ERR_INVALID_VALUE if any argument was invalid
*/
int setIpFwSettings(in IpFw ipFw);
/**
* Retrieve the IPv6 packet filter configuration.
*
* @return %IPv6 packet filter configuration
*/
IpFw getIpV6FwSettings();
/**
* Set the IPv6 packet filter configuration.
*
* @param ipV6Fw New packet filter settings
*
* @return 0 on success
* @return ERR_INVALID_VALUE if any argument was invalid
*/
int setIpV6FwSettings(in IpFw ipV6Fw);
/**
* Retrieve the role-base access control settings for IPv4.
*
* @return Role-based access control settings
*/
RoleAccessControl getRoleAccessControlSettings();
/**
* Change the role-based access control settings.
*
* @param settings New settings
*
* @return 0 on success
* @return ERR_INVALID_VALUE if any argument was invalid
*/
int setRoleAccessControlSettings(in RoleAccessControl settings);
/**
* Retrieve the role-base access control settings for IPv6.
*
* @return Role-based access control settings
*/
RoleAccessControl getRoleAccessControlSettingsV6();
/**
* Change the role-based access control settings for IPv6.
*
* @param settings New settings
*
* @return 0 on success
* @return ERR_INVALID_VALUE if any argument was invalid
*/
int setRoleAccessControlSettingsV6(in RoleAccessControl settings);
/**
* Retrieve the current user blocking settings
*
* @return User blocking settings
*/
BlockSettings getBlockSettings();
/**
* Change the user blocking settings.
*
* @param settings New settings
*
* @return 0 on success
* @return ERR_INVALID_VALUE if any argument was invalid
*/
int setBlockSettings(in BlockSettings settings);
/**
* Retrieve the password settings.
*
* @return Password settings
*/
PasswordSettings getPwSettings();
/**
* Change the password settings.
*
* @param pwSettings New settings
*
* @return 0 on success
* @return ERR_INVALID_VALUE if any argument was invalid
*/
int setPwSettings(in PasswordSettings pwSettings);
/**
* Retrieve the current idle timeout.
*
* @return Idle timeout in minutes
*/
int getIdleTimeoutSettings();
/**
* Change the session idle timeout.
*
* @param idleTimeout New idle timeout in minutes
*
* @return 0 on success
* @return ERR_INVALID_VALUE if any argument was invalid
*/
int setIdleTimeoutSettings(in int idleTimeout);
/**
* Retrieve the current single-login limitation setting.
*
* @return \c true if single-login limitation is enabled
*/
boolean getSingleLoginLimitation();
/**
* Enable or disable single login limitation.
*
* @param singleLogin \c true to enable single login limitation
*/
void setSingleLoginLimitation(in boolean singleLogin);
/**
* Retrieve the current SSH settings
*
* @return SSH settings
*/
SSHSettings getSSHSettings();
/**
* Change the SSH settings
*
* @param settings New settings
*/
void setSSHSettings(in SSHSettings settings);
/**
* Retrieve the host SSH keys
*
* @return SSH host keys
*/
vector<SSHHostKey> getSSHHostKeys();
/**
* Retrieve the current Restricted Service Agreement settings
*
* @return Restricted Service Agreement settings
*/
RestrictedServiceAgreement getRestrictedServiceAgreement();
/**
* Change the Restricted Service Agreement settings
*
* @param settings New settings
*
* @return 0 on success
* @return ERR_INVALID_VALUE if any argument was invalid
*/
int setRestrictedServiceAgreement(in RestrictedServiceAgreement settings);
/**
* Retrieve a list of supported privileges for the front panel
*
* @return List of privilege names
*/
vector<string> getSupportedFrontPanelPrivileges();
/**
* Retrieve the list of active front panel privileges
*
* @return List of privilege names
*/
vector<string> getFrontPanelPrivileges();
/**
* Set the privileges for the front panel
*
* @return 0 on success
* @return ERR_INVALID_VALUE if any argument was invalid
*/
int setFrontPanelPrivileges(in vector<string> privileges);
/**
* Set the default admin account password and optionally disable strong password requirements.
*
* The purpose of this method is to set the default admin account password when the device is
* unprovisioned, i.e. has not been configured yet or has been reset to factory defaults. The
* difference to the regular setAccountPassword() method in the User.idl is that this method
* allows to disable the strong password requirements at the same time. It allows choosing a
* weaker password in case strong password requirements are not needed for the specific purpose.
*
* @param password The new password
* @param disableStrongPasswordReq \c true to disable strong password requirements
* \c false to keep the current strong password requirement setting
*
* @return 0 OK
* @return 1 The new password has to differ from old password.
* @return 2 The password must not be empty.
* @return 3 The password is too short.
* @return 4 The password is too long.
* @return 5 The password must not contain control characters.
* @return 6 The password has to contain at least one lower case character.
* @return 7 The password has to contain at least one upper case character.
* @return 8 The password has to contain at least one numeric character.
* @return 9 The password has to contain at least one printable special character.
* @return 10 The password already is in history.
* @return 11 SNMPv3 USM is activated for the user and the password shall be used as auth passphrase.
* For this case, the password is too short (must be at least 8 characters).
*/
int setDefaultAdminAccountPassword(in string password, in boolean disableStrongPasswordReq);
/**
* Check whether secure boot is active.
*
* ATTENTION: There are some uncertainties involved here. It is possible that it reports secure boot
* active while it isn't. Theoretically also the opposite is possible. For that reason
* the result of this function may not be used to reduce any security checks!
*
* @return \c true if secure boot is active
*/
boolean isSecureBootActive();
/**
* Return information about an installed Trusted Platform Module (TPM).
*
* @return TPM information
*/
TpmInfo getTpmInfo();
};
}
security::Security
Security configuration interface
Definition Security.idl:139
security::Security::setIpV6FwSettings
int setIpV6FwSettings(in IpFw ipV6Fw)
Set the IPv6 packet filter configuration.
security::Security::getBlockSettings
BlockSettings getBlockSettings()
Retrieve the current user blocking settings.
security::Security::getHttpRedirSettings
boolean getHttpRedirSettings()
Retrieve the current state of the HTTP-to-HTTPS redirection.
security::Security::setSingleLoginLimitation
void setSingleLoginLimitation(in boolean singleLogin)
Enable or disable single login limitation.
security::Security::setRoleAccessControlSettingsV6
int setRoleAccessControlSettingsV6(in RoleAccessControl settings)
Change the role-based access control settings for IPv6.
security::Security::isHstsEnabled
boolean isHstsEnabled()
Check whether HTTP Strict Transport Security (HSTS) is enabled.
security::Security::getSingleLoginLimitation
boolean getSingleLoginLimitation()
Retrieve the current single-login limitation setting.
security::Security::setDefaultAdminAccountPassword
int setDefaultAdminAccountPassword(in string password, in boolean disableStrongPasswordReq)
Set the default admin account password and optionally disable strong password requirements.
security::Security::getTpmInfo
TpmInfo getTpmInfo()
Return information about an installed Trusted Platform Module (TPM).
security::Security::setHstsEnabled
void setHstsEnabled(in boolean enable)
Enable or disable HTTP Strict Transport Security (HSTS).
security::Security::getPwSettings
PasswordSettings getPwSettings()
Retrieve the password settings.
security::Security::getSupportedFrontPanelPrivileges
vector< string > getSupportedFrontPanelPrivileges()
Retrieve a list of supported privileges for the front panel.
security::Security::setIdleTimeoutSettings
int setIdleTimeoutSettings(in int idleTimeout)
Change the session idle timeout.
security::Security::getFrontPanelPrivileges
vector< string > getFrontPanelPrivileges()
Retrieve the list of active front panel privileges.
security::Security::setIpFwSettings
int setIpFwSettings(in IpFw ipFw)
Set the IPv4 packet filter configuration.
security::Security::setSSHSettings
void setSSHSettings(in SSHSettings settings)
Change the SSH settings.
security::Security::getSSHHostKeys
vector< SSHHostKey > getSSHHostKeys()
Retrieve the host SSH keys.
security::Security::getIpFwSettings
IpFw getIpFwSettings()
Retrieve the IPv4 packet filter configuration.
security::Security::getRoleAccessControlSettings
RoleAccessControl getRoleAccessControlSettings()
Retrieve the role-base access control settings for IPv4.
security::Security::isSecureBootActive
boolean isSecureBootActive()
Check whether secure boot is active.
security::Security::setHttpRedirSettings
void setHttpRedirSettings(in boolean http2httpsRedir)
Enable or disable HTTP-to-HTTPS redirection.
security::Security::setRestrictedServiceAgreement
int setRestrictedServiceAgreement(in RestrictedServiceAgreement settings)
Change the Restricted Service Agreement settings.
security::Security::setRoleAccessControlSettings
int setRoleAccessControlSettings(in RoleAccessControl settings)
Change the role-based access control settings.
security::Security::setPwSettings
int setPwSettings(in PasswordSettings pwSettings)
Change the password settings.
security::Security::getRoleAccessControlSettingsV6
RoleAccessControl getRoleAccessControlSettingsV6()
Retrieve the role-base access control settings for IPv6.
security::Security::getIdleTimeoutSettings
int getIdleTimeoutSettings()
Retrieve the current idle timeout.
security::Security::getIpV6FwSettings
IpFw getIpV6FwSettings()
Retrieve the IPv6 packet filter configuration.
security::Security::getSSHSettings
SSHSettings getSSHSettings()
Retrieve the current SSH settings.
security::Security::setFrontPanelPrivileges
int setFrontPanelPrivileges(in vector< string > privileges)
Set the privileges for the front panel.
security::Security::setBlockSettings
int setBlockSettings(in BlockSettings settings)
Change the user blocking settings.
security::Security::getRestrictedServiceAgreement
RestrictedServiceAgreement getRestrictedServiceAgreement()
Retrieve the current Restricted Service Agreement settings.
security
Security Configuration
Definition Security.idl:11
security::SSHHostKeyType
SSHHostKeyType
Type of SSH host key.
Definition Security.idl:84
security::RoleAccessPolicy
RoleAccessPolicy
Role-based access policy.
Definition Security.idl:36
security::DENY
@ DENY
Access denied.
Definition Security.idl:38
security::ALLOW
@ ALLOW
Access granted.
Definition Security.idl:37
security::IpfwPolicy
IpfwPolicy
IP packet filter policy.
Definition Security.idl:14
security::REJECT
@ REJECT
Discard packet, send error response.
Definition Security.idl:17
security::DROP
@ DROP
Silently discard the packet.
Definition Security.idl:16
security::ACCEPT
@ ACCEPT
Accept the packet.
Definition Security.idl:15
security::SSHKeyFingerprintType
SSHKeyFingerprintType
Type of SSH key fingerprint.
Definition Security.idl:91
security::BlockSettings
User blocking settings.
Definition Security.idl:57
security::BlockSettings::maxFailedLogins
int maxFailedLogins
The number of failed logins before blocking a user.
Definition Security.idl:58
security::BlockSettings::failedLoginTimeout
int failedLoginTimeout
Time (in minutes) before resetting the failure counter.
Definition Security.idl:60
security::BlockSettings::blockTimeout
int blockTimeout
Time (in minutes) the account will be blocked.
Definition Security.idl:59
security::FrontPanelPrivilegesChanged
Front panel privileges have been changed.
Definition Security.idl:133
security::FrontPanelPrivilegesChanged::oldPrivileges
vector< string > oldPrivileges
old front panel privileges
Definition Security.idl:134
security::FrontPanelPrivilegesChanged::newPrivileges
vector< string > newPrivileges
new front panel privileges
Definition Security.idl:135
security::IpFw
IP packet filter configuration.
Definition Security.idl:27
security::IpFw::enabled
boolean enabled
true to enable packet filtering
Definition Security.idl:28
security::IpFw::ruleSetOut
vector< IpfwRule > ruleSetOut
Ordered list of outbound firewall rules.
Definition Security.idl:32
security::IpFw::ruleSetIn
vector< IpfwRule > ruleSetIn
Ordered list of inbound firewall rules.
Definition Security.idl:31
security::IpFw::defaultPolicyIn
IpfwPolicy defaultPolicyIn
The default policy for inbound traffic in case no rule matches.
Definition Security.idl:29
security::IpFw::defaultPolicyOut
IpfwPolicy defaultPolicyOut
The default policy for outbound traffic in case no rule matches.
Definition Security.idl:30
security::IpfwRule
IP packet filter rule.
Definition Security.idl:21
security::IpfwRule::policy
IpfwPolicy policy
Filter policy.
Definition Security.idl:23
security::IpfwRule::ipMask
string ipMask
Remote IP and network mask.
Definition Security.idl:22
security::PasswordSettingsChanged
This Event is emitted after any of the password-settings has been changed.
Definition Security.idl:125
security::PasswordSettings
Password settings.
Definition Security.idl:64
security::PasswordSettings::enableStrongReq
boolean enableStrongReq
true to enable strong password requirements
Definition Security.idl:67
security::PasswordSettings::enableAging
boolean enableAging
true to enable password aging
Definition Security.idl:65
security::PasswordSettings::enforceSpecial
boolean enforceSpecial
Passwords must contain at least one special character.
Definition Security.idl:73
security::PasswordSettings::enforceNumeric
boolean enforceNumeric
Passwords must contain at least one numeric character.
Definition Security.idl:72
security::PasswordSettings::pwHistoryDepth
int pwHistoryDepth
Number of entries in password history.
Definition Security.idl:74
security::PasswordSettings::enforceUpper
boolean enforceUpper
Passwords must contain at least one upper case character.
Definition Security.idl:71
security::PasswordSettings::maxPwLength
int maxPwLength
Maximum password length.
Definition Security.idl:69
security::PasswordSettings::agingInterval
int agingInterval
Aging interval in days.
Definition Security.idl:66
security::PasswordSettings::enforceLower
boolean enforceLower
Passwords must contain at least one lower case character.
Definition Security.idl:70
security::PasswordSettings::minPwLength
int minPwLength
Minimum password length.
Definition Security.idl:68
security::RestrictedServiceAgreement
Restricted Service Agreement settings.
Definition Security.idl:111
security::RestrictedServiceAgreement::banner
string banner
Restricted Service Agreement Banner.
Definition Security.idl:113
security::RestrictedServiceAgreement::enabled
boolean enabled
Enforce Restricted Service Agreement.
Definition Security.idl:112
security::RoleAccessControl
Role-based access control settings.
Definition Security.idl:50
security::RoleAccessControl::defaultPolicy
RoleAccessPolicy defaultPolicy
Default policy.
Definition Security.idl:52
security::RoleAccessControl::enabled
boolean enabled
true to enable role-based access control
Definition Security.idl:51
security::RoleAccessControl::rules
vector< RoleAccessRule > rules
List of access rules.
Definition Security.idl:53
security::RoleAccessRule
Role-based access rule.
Definition Security.idl:42
security::RoleAccessRule::policy
RoleAccessPolicy policy
Access policy.
Definition Security.idl:46
security::RoleAccessRule::endIp
string endIp
End of IP range.
Definition Security.idl:44
security::RoleAccessRule::roleId
int roleId
Role id.
Definition Security.idl:45
security::RoleAccessRule::startIp
string startIp
Start of IP range.
Definition Security.idl:43
security::SSHHostKey
SSH host keys.
Definition Security.idl:104
security::SSHHostKey::key
string key
Public key.
Definition Security.idl:105
security::SSHHostKey::fingerprints
vector< SSHKeyFingerprint > fingerprints
Fingerprints of public key.
Definition Security.idl:107
security::SSHHostKey::type
SSHHostKeyType type
Type of public key.
Definition Security.idl:106
security::SSHKeyFingerprint
Fingerprints of SSH host key.
Definition Security.idl:98
security::SSHKeyFingerprint::type
SSHKeyFingerprintType type
Type of fingerprint.
Definition Security.idl:100
security::SSHKeyFingerprint::fingerprint
string fingerprint
Fingerprint of SSH key.
Definition Security.idl:99
security::SSHSettings
SSH authentication settings.
Definition Security.idl:78
security::SSHSettings::allowPasswordAuth
boolean allowPasswordAuth
Allow password authentication.
Definition Security.idl:79
security::SSHSettings::allowPublicKeyAuth
boolean allowPublicKeyAuth
Allow public key authentication.
Definition Security.idl:80
security::TpmInfo
Information about Trusted Platform Module.
Definition Security.idl:117