Skip to content

Commit ae3100c

Browse files
hprestonhpreston
authored
Merge pull request CiscoDevNet#3 from krishna426426/master
added scripts and README file for Model Based AAA
2 parents c0d7f98 + fa7ea8d commit ae3100c

9 files changed

+572
-0
lines changed

‎model-based-aaa/.DS_Store

6 KB
Binary file not shown.

‎model-based-aaa/README.md

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# Model Based AAA
2+
3+
The NETCONF and RESTCONF are industry standard protocols uses YANG data models for managing network devices. These protocols do not provide any mechanism for authorizing a user with different privilege levels. Every NETCONF or RESTCONF user is a super user with privilege level 15.
4+
5+
NETCONF Access Control Model is a form of role-based access control (RBAC) specified in RFC 6536 can provide rules for privilege levels. A user can be authorized with aaa new-model and the privilege level is determined for that user, in the absence of aaa new-model configuration the locally configured privilege level is used. Using NACM you can set rules to that privilege level to control what to access for that user. It is a group-based authorization scheme for data and operations modeled in YANG.
6+
7+
These are examples scripts for the Model Based AAA to retrieve, edit and delete the rules for a privilege level by using ietf-netconf-acm.yang data model. There are also examples for configuring and deleting users in a group.
8+
9+
## requirements
10+
11+
-- ncclient
12+
-- IOS-XE running >/= 16.8 also enabled for NETCONF
13+

‎model-based-aaa/delete-config_user.py

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
"""
2+
#!/usr/bin/env python
3+
#
4+
# Copyright (c) 2017 Krishna Kotha <krkotha@cisco.com>
5+
# All rights reserved.
6+
#
7+
# Redistribution and use in source and binary forms, with or without
8+
# modification, are permitted provided that the following conditions
9+
# are met:
10+
# 1. Redistributions of source code must retain the above copyright
11+
# notice, this list of conditions and the following disclaimer.
12+
# 2. Redistributions in binary form must reproduce the above copyright
13+
# notice, this list of conditions and the following disclaimer in the
14+
# documentation and/or other materials provided with the distribution.
15+
#
16+
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17+
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18+
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19+
# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20+
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21+
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22+
# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23+
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24+
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25+
# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26+
# SUCH DAMAGE.
27+
#
28+
# This script retrieves entire configuration from a network element via NETCONF
29+
# prints it out in a "pretty" XML tree.)
30+
#
31+
# Installing python dependencies:
32+
# > pip install lxml ncclient
33+
#
34+
# Running script: (save as example.py)
35+
# > python example.py -a 172.26.198.63 -u cisco -p cisco --port 830
36+
"""
37+
38+
import lxml.etree as ET
39+
from argparse import ArgumentParser
40+
from ncclient import manager
41+
from ncclient.operations import RPCError
42+
43+
payload = """
44+
<config xmlns:xc="urn:ietf:params:xml:ns:netconf:base:1.0" xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
45+
<nacm xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-acm">
46+
<rule-list xc:operation="delete">
47+
<name>priv04-group</name>
48+
</rule-list>
49+
</nacm>
50+
</config>
51+
"""
52+
53+
if __name__ == '__main__':
54+
55+
parser = ArgumentParser(description='Usage:')
56+
57+
# script arguments
58+
parser.add_argument('-a', '--host', type=str, required=True,
59+
help="Device IP address or Hostname")
60+
parser.add_argument('-u', '--username', type=str, required=True,
61+
help="Device Username (netconf agent username)")
62+
parser.add_argument('-p', '--password', type=str, required=True,
63+
help="Device Password (netconf agent password)")
64+
parser.add_argument('--port', type=int, default=830,
65+
help="Netconf agent port")
66+
args = parser.parse_args()
67+
68+
# connect to netconf agent
69+
with manager.connect(host=args.host,
70+
port=args.port,
71+
username=args.username,
72+
password=args.password,
73+
timeout=90,
74+
hostkey_verify=False,
75+
device_params={'name': 'csr'}) as m:
76+
77+
# execute netconf operation
78+
try:
79+
response = m.edit_config(target='running', config=payload).xml
80+
data = ET.fromstring(response)
81+
except RPCError as e:
82+
data = e._raw
83+
84+
# beautify output
85+
print(ET.tostring(data, pretty_print=True))

‎model-based-aaa/edit-config-permit-native.py

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
#!/usr/bin/env python
2+
#
3+
# Copyright (c) 2017 Krishna Kotha <krkotha@cisco.com>
4+
# All rights reserved.
5+
#
6+
# Redistribution and use in source and binary forms, with or without
7+
# modification, are permitted provided that the following conditions
8+
# are met:
9+
# 1. Redistributions of source code must retain the above copyright
10+
# notice, this list of conditions and the following disclaimer.
11+
# 2. Redistributions in binary form must reproduce the above copyright
12+
# notice, this list of conditions and the following disclaimer in the
13+
# documentation and/or other materials provided with the distribution.
14+
#
15+
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16+
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17+
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18+
# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19+
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20+
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21+
# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22+
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23+
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24+
# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25+
# SUCH DAMAGE.
26+
#
27+
# This script retrieves entire configuration from a network element via NETCONF
28+
# prints it out in a "pretty" XML tree.)
29+
#
30+
# Installing python dependencies:
31+
# > pip install lxml ncclient
32+
#
33+
# Running script: (save as example.py)
34+
# > python example.py --host 172.26.198.63 -u cisco -p cisco
35+
36+
import sys
37+
from argparse import ArgumentParser
38+
from ncclient import manager
39+
import xml.dom.minidom
40+
41+
data = '''
42+
<config xmlns:xc="urn:ietf:params:xml:ns:netconf:base:1.0" xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
43+
<nacm xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-acm">
44+
<rule-list>
45+
<name>priv04-group</name>
46+
<group>PRIV04</group>
47+
<rule>
48+
<name>permit-read-native</name>
49+
<module-name>Cisco-IOS-XE-native</module-name>
50+
<access-operations>read</access-operations>
51+
<action>permit</action>
52+
</rule>
53+
</rule-list>
54+
</nacm>
55+
</config>
56+
'''
57+
58+
if __name__ == '__main__':
59+
parser = ArgumentParser(description='Select options.')
60+
# Input parameters
61+
parser.add_argument('--host', type=str, required=True,
62+
help="The device IP or DN")
63+
parser.add_argument('-u', '--username', type=str, default='cisco',
64+
help="Go on, guess!")
65+
parser.add_argument('-p', '--password', type=str, default='cisco',
66+
help="Yep, this one too! ;-)")
67+
parser.add_argument('--port', type=int, default=830,
68+
help="Specify this if you want a non-default port")
69+
args = parser.parse_args()
70+
m = manager.connect(host=args.host,
71+
port=args.port,
72+
username=args.username,
73+
password=args.password,
74+
device_params={'name':"csr"})
75+
# Pretty print the XML reply
76+
xmlDom = xml.dom.minidom.parseString( str( m.edit_config(data, target='running') ) )
77+
print xmlDom.toprettyxml( indent = " " )

‎model-based-aaa/edit-config-permit-netconf-native.py

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
#!/usr/bin/env python
2+
#
3+
# Copyright (c) 2017 Krishna Kotha <krkotha@cisco.com>
4+
# All rights reserved.
5+
#
6+
# Redistribution and use in source and binary forms, with or without
7+
# modification, are permitted provided that the following conditions
8+
# are met:
9+
# 1. Redistributions of source code must retain the above copyright
10+
# notice, this list of conditions and the following disclaimer.
11+
# 2. Redistributions in binary form must reproduce the above copyright
12+
# notice, this list of conditions and the following disclaimer in the
13+
# documentation and/or other materials provided with the distribution.
14+
#
15+
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16+
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17+
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18+
# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19+
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20+
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21+
# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22+
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23+
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24+
# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25+
# SUCH DAMAGE.
26+
#
27+
# This script retrieves entire configuration from a network element via NETCONF
28+
# prints it out in a "pretty" XML tree.)
29+
#
30+
# Installing python dependencies:
31+
# > pip install lxml ncclient
32+
#
33+
# Running script: (save as example.py)
34+
# > python example.py --host 172.26.198.63 -u cisco -p cisco
35+
36+
import sys
37+
from argparse import ArgumentParser
38+
from ncclient import manager
39+
import xml.dom.minidom
40+
41+
data = '''
42+
<config xmlns:xc="urn:ietf:params:xml:ns:netconf:base:1.0" xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
43+
<nacm xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-acm">
44+
<rule-list>
45+
<name>priv04-group</name>
46+
<group>PRIV04</group>
47+
<rule>
48+
<name>permit-netconf-rpc</name>
49+
<module-name>ietf-netcon</module-name>
50+
<access-operations>exec</access-operations>
51+
<action>permit</action>
52+
</rule>
53+
<rule>
54+
<name>permit-read-native</name>
55+
<module-name>Cisco-IOS-XE-native</module-name>
56+
<access-operations>read</access-operations>
57+
<action>permit</action>
58+
</rule>
59+
</rule-list>
60+
</nacm>
61+
</config>
62+
'''
63+
64+
if __name__ == '__main__':
65+
parser = ArgumentParser(description='Select options.')
66+
# Input parameters
67+
parser.add_argument('--host', type=str, required=True,
68+
help="The device IP or DN")
69+
parser.add_argument('-u', '--username', type=str, default='cisco',
70+
help="Go on, guess!")
71+
parser.add_argument('-p', '--password', type=str, default='cisco',
72+
help="Yep, this one too! ;-)")
73+
parser.add_argument('--port', type=int, default=830,
74+
help="Specify this if you want a non-default port")
75+
args = parser.parse_args()
76+
m = manager.connect(host=args.host,
77+
port=args.port,
78+
username=args.username,
79+
password=args.password,
80+
device_params={'name':"csr"})
81+
# Pretty print the XML reply
82+
xmlDom = xml.dom.minidom.parseString( str( m.edit_config(data, target='running') ) )
83+
print xmlDom.toprettyxml( indent = " " )

‎model-based-aaa/edit-config-permit-netconf.py

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
#!/usr/bin/env python
2+
#
3+
# Copyright (c) 2017 Krishna Kotha <krkotha@cisco.com>
4+
# All rights reserved.
5+
#
6+
# Redistribution and use in source and binary forms, with or without
7+
# modification, are permitted provided that the following conditions
8+
# are met:
9+
# 1. Redistributions of source code must retain the above copyright
10+
# notice, this list of conditions and the following disclaimer.
11+
# 2. Redistributions in binary form must reproduce the above copyright
12+
# notice, this list of conditions and the following disclaimer in the
13+
# documentation and/or other materials provided with the distribution.
14+
#
15+
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16+
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17+
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18+
# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19+
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20+
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21+
# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22+
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23+
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24+
# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25+
# SUCH DAMAGE.
26+
#
27+
# This script retrieves entire configuration from a network element via NETCONF
28+
# prints it out in a "pretty" XML tree.)
29+
#
30+
# Installing python dependencies:
31+
# > pip install lxml ncclient
32+
#
33+
# Running script: (save as example.py)
34+
# > python example.py --host 172.26.198.63 -u cisco -p cisco
35+
36+
import sys
37+
from argparse import ArgumentParser
38+
from ncclient import manager
39+
import xml.dom.minidom
40+
41+
data = '''
42+
<config xmlns:xc="urn:ietf:params:xml:ns:netconf:base:1.0" xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
43+
<nacm xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-acm">
44+
<rule-list>
45+
<name>priv04-group</name>
46+
<group>PRIV04</group>
47+
<rule>
48+
<name>permit-netconf-rpc</name>
49+
<module-name>ietf-netconf</module-name>
50+
<access-operations>exec</access-operations>
51+
<action>permit</action>
52+
</rule>
53+
</rule-list>
54+
</nacm>
55+
</config>
56+
'''
57+
58+
if __name__ == '__main__':
59+
parser = ArgumentParser(description='Select options.')
60+
# Input parameters
61+
parser.add_argument('--host', type=str, required=True,
62+
help="The device IP or DN")
63+
parser.add_argument('-u', '--username', type=str, default='cisco',
64+
help="Go on, guess!")
65+
parser.add_argument('-p', '--password', type=str, default='cisco',
66+
help="Yep, this one too! ;-)")
67+
parser.add_argument('--port', type=int, default=830,
68+
help="Specify this if you want a non-default port")
69+
args = parser.parse_args()
70+
m = manager.connect(host=args.host,
71+
port=args.port,
72+
username=args.username,
73+
password=args.password,
74+
device_params={'name':"csr"})
75+
# Pretty print the XML reply
76+
xmlDom = xml.dom.minidom.parseString( str( m.edit_config(data, target='running') ) )
77+
print xmlDom.toprettyxml( indent = " " )

0 commit comments

Comments
 (0)