get_users() support? about napalm-opengear

[r0bertw]

All passwords are MD5 hashed in /etc/shadow and not stored in config.xml, except for users that are in the PSTN dialin group (we recommend using a separate auxiliary account for dialin auth).

You can set the config.users.userX.password field to whatever you want writing directly to the shadow file's encrypted password field, or you can set config.users.userX.plaintext_password and the configurator will encrypt it for you. In both cases the passwords are removed from config.xml by the configurator as it runs.

The examples at the end of KB article might be useful: https://opengear.zendesk.com/hc/en-us/articles/216371303-Managing-local-users-from-the-command-line

If you remove and then re-add a user and then finally run the configurator, I would've thought the user's homedir would be untouched.

[r0bertw]

The API on our mainstream “OG” products (IM, ACM, CM) doesn’t have full parity with UI/CLI, so I’d probably continue via CLI.

[yeled]

you can set config.users.userX.plaintext_password and the configurator will encrypt it for you. In both cases the passwords are removed from config.xml by the configurator as it runs

Wow really! I had to strip plaintext_password from the XML for our own security reasons. Let me experiment with that.

It sounds delightful being able to run config -s config.users.${foo}.password=${bar} with the same MD5 hash that's in /etc/shadow! This would be Junos and EOS parity.

[yeled]

Just had a call with OpenGear. Perhaps we should limit opengear support to >4.6.0 and use the API instead?

[yeled]

and use the API instead?

oh, https://ftp.opengear.com/download/api/cs/og-cs-rest-api-specification-v1.4.html#users_get doesn't fetch the password.

We'll need to scrape /etc/shadow if we wanted parity with say, junos.

Or we just never report the password? might be much easier and on message with the OpenGear way.