Repository navigation
Limit the information from the support script introduced in #1287 #1291
Description
Description
For security reasons limit the information given in show running, remove private keys, passwords and hashes.
For example ignore all nodes in the schema defined as default deny;
Additional Information
No response
General Information
Anyone can help out by sponsoring development of new features or contributing pull requests.
Please use this issue for discussions related to the feature.
Activity
troglobit commentedon Dec 1, 2025
What would be great here is if we could have an
operatorlevel userCurrent state
adminwith fullpermit-all accessadmincan bypass it)nacm:default-deny-allextensions in YANG models would work, but only if there's a non-admin userWhat's needed
operatorgroup - Can read most config (sensitive data filtered out), can make configuration changes, but perhaps restricted from:- Reading private keys, passwords, shared secrets (respects nacm:default-deny-all)
- Factory reset operations
- User management
- NACM rule changes
- View operational state (interface status, routes, statistics)
- Cannot read any configuration
- Cannot make any changes
This would make the support collect command much safer when run by an operator user - sensitive data would be automatically filtered by sysrepo's NACM implementation without needing any custom filtering code.
The beauty of this approach is that it leverages the existing
nacm:default-deny-allmarkings already present in the YANG models, making it maintainable and consistent with the NETCONF/YANG standards.troglobit commentedon Oct 5, 2026
Fixed on
main@ 44a308a for v26.09