fix_snmp: a sudo that does not prompt writes the sudo password into snmpd.conf #8

New Issue

2026-10-12T18:38:39Z

christianmanivong commented

2026-10-12 18:38:39 +00:00

What happens: napalm_bsd/base.py::_action_fix_snmp (around lines 418–434) runs its config step as
mkdir -p … && cat > {SNMPD_CONF} && chmod 644 {SNMPD_CONF} with privileged=True, stdin=_SNMPD_CONF.
napalm-bsd's own run_command (base.py:150-161) puts the sudo password in front of stdin for sudo -S. When sudo does not prompt (NOPASSWD, or a cached timestamp), it leaves the password line on stdin, and cat writes it as line 1 of a world-readable snmpd.conf.

This is the same bug as NetOrk/netork#1029 (seen for real on 2026-10-11 with the SSH fix). The napalm-linux guard from #1029 does not cover napalm-bsd, because its run_command is its own implementation, not a LinuxDriver subclass.

Fix:

Stage the config without privilege (umask 077; mktemp; cat), then have root run install -m 644 <staged> <SNMPD_CONF>; rm <staged>. This is the pattern of napalm-device-types ssh_server.py::_ssh_write.
Add the same guard to run_command: refuse privileged=True together with stdin while a sudo password is set.
tests/test_drivers.py:486: its fake does not prepend a password to privileged stdin, so the test cannot see this. Make the fake model it.

Prio: P2 (credential leak). Found while working on NetOrk/netork#1029.

**What happens:** `napalm_bsd/base.py::_action_fix_snmp` (around lines 418–434) runs its config step as `mkdir -p … && cat > {SNMPD_CONF} && chmod 644 {SNMPD_CONF}` with `privileged=True, stdin=_SNMPD_CONF`. napalm-bsd's own `run_command` (`base.py:150-161`) puts the sudo password in front of stdin for `sudo -S`. When sudo does not prompt (NOPASSWD, or a cached timestamp), it leaves the password line on stdin, and `cat` writes it as line 1 of a world-readable `snmpd.conf`. This is the same bug as NetOrk/netork#1029 (seen for real on 2026-10-11 with the SSH fix). The napalm-linux guard from #1029 does not cover napalm-bsd, because its `run_command` is its own implementation, not a LinuxDriver subclass. **Fix:** - Stage the config without privilege (`umask 077; mktemp; cat`), then have root run `install -m 644 <staged> <SNMPD_CONF>; rm <staged>`. This is the pattern of napalm-device-types `ssh_server.py::_ssh_write`. - Add the same guard to `run_command`: refuse `privileged=True` together with `stdin` while a sudo password is set. - `tests/test_drivers.py:486`: its fake does not prepend a password to privileged stdin, so the test cannot see this. Make the fake model it. Prio: P2 (credential leak). Found while working on NetOrk/netork#1029.

christianmanivong referenced this issue from NAPALM/napalm-linux

2026-10-12 18:42:41 +00:00

fix: refuse stdin to a privileged command while a sudo password is set #24

christianmanivong referenced this issue

2026-10-14 08:22:58 +00:00

fix_snmp becomes the SNMP template's steps #12

christianmanivong referenced this issue

2026-10-14 08:22:58 +00:00

Use napalm-unix; take over the FreeBSD reboot check from device-types #14

christianmanivong referenced this issue from a commit

2026-10-16 09:48:26 +00:00

fix: keep the sudo password out of files written as root (0.2.1)