rock ju
rock ju

Reputation: 13

Ip xfrm state command displays key information, which may cause information leakage. Is there any way to prevent users from viewing key information?

Ip xfrm state command displays key information, which may cause information leakage.In the following, the auth-trunc hmac and enc cbc will cause key information leakage. Is there any way to prevent users from viewing key information in any case? Although this command must be executed by the root user, but I think the IPSec key information configured by non-root users should not be disclosed.

ip xfrm state: src 192.168.244.52 dst 192.168.244.53 proto esp spi 0x12345678 reqid 305419896 mode tunnel replay-window 0 auth-trunc hmac(sha256) 0x1234567890123456789012345678901234567890123456789012345678901234 96 enc cbc(aes) 0x0000123456789012345678901234567890123456789012345678901234567890 anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000 sel src 0.0.0.0/0 dst 0.0.0.0/0 src 192.168.244.53 dst 192.168.244.52 proto esp spi 0x12345678 reqid 305419896 mode tunnel replay-window 0 auth-trunc hmac(sha256) 0x1234567890123456789012345678901234567890123456789012345678901234 96 enc cbc(aes) 0x0000123456789012345678901234567890123456789012345678901234567890 anti-replay context: seq 0x0, oseq 0x196, bitmap 0x00000000 sel src 0.0.0.0/0 dst 0.0.0.0/0

I saw that could use ip xfrm state list nokeys commond to prevent key information from being printed, but that didn't solve my problem.

xfrm: add option to hide keys in state output: https://patchwork.ozlabs.org/project/netdev/patch/[email protected]/

Upvotes: 0

Views: 463

Answers (0)

Related Questions