3

I'm implementing a new TACACS server on our network after having removed the old TACACS server which we no longer own. I've already gotten the implementation working with the NX-OS devices, but when attempting to add the tacacs-server host x.x.x.x key 7 ENCRYPTED_KEY command I get the following error:

%Invalid encrypted key:

I did notice that the encrypted keys on the NX-OS devices are listed in alphanumeric, but the old tacacs keys on the IOS15 devices are listed in hexadecimal. Do I need to run the keys through a different hashing algorithm on the TACACS server for the IOS15 devices?

  • Stupid question: Did you try the config with the cleartext key, to see what is afterwards being shown in show run - if there's a different hash/encryption or not? – xpac Feb 19 '16 at 15:01
  • Unfortunately the senior network admin created the key, encrypted it, and sent me the encrypted key. I don't have the cleartext, and he's out for the next few days. – EnduranceMan Feb 19 '16 at 15:10
  • So, NX-OS works, IOS 15 doesn't, right? – xpac Feb 19 '16 at 15:11
  • That's correct. – EnduranceMan Feb 19 '16 at 15:12
2

To answer your question: Yes. ;)

Problem solution is actually easy, as it turns out - I will be quoting what I found out:

The NX-OS password scheme is a normal rotation cipher. This is the sequence:

3 22 4 5 18 0 21 5 18 3 10 5 16 22 4 16 24 17 12 5 21 18 5 22 19 7

This means for 'cisco123'

c + 3 = f
i + 22 - 26 (i+22 is > 26) = i - 4 = e
s + 4 = w
c + 5 = h
o + 18 - 26 (o+18 is > 26) = o - 8 = g

Numbers and other non-alphabetic characters are unchanged.

Source: Comments on http://blog.ipspace.net/2007/11/type-7-decryption-in-cisco-ios.html

This way - decrypt the key, enter it cleartext on your first IOS device, copy the decrypted key from show run - you're done.

| improve this answer | |
  • So I've decrypted the key from the nexus device with that pattern, then entered it via a key chain command and copied the 7 type encryption from show run, but get a user rejected error from the tacacs server now, I think the key might not be correct? – EnduranceMan Feb 19 '16 at 15:49
  • When you decrypted the key, did it look like something that makes sense (a word or something)? Remember that, in contradiction to the example above, you have to do it backwards, which means subtracting the numbers to get the clear text key. Afterwards, just use that key as it is in tacacs-serverhost x.x.x.x key DECRYPTEDKEY, no need for key chain magic here. – xpac Feb 19 '16 at 15:52
  • Ah that's what I did wrong, thanks for the reminder. – EnduranceMan Feb 19 '16 at 19:13
  • @EnduranceMan If that solved your problem, you may mark my answer as accepted, so everybody can easily see that no more effort needs to be put in here ;-) – xpac Feb 20 '16 at 11:08
0

The following perl code will encrypt/decrypt based on the above. Not the most elegant or compact code, but it works.

use Readonly;
Readonly my @nxseq => ( 3, 22, 4, 5, 18, 0, 21, 5, 18, 3, 10, 5, 16, 22, 4, 16, 24, 17, 12, 5, 21, 18, 5, 22, 19, 7 );

sub encrypt_nxos7 {
    my $ep = shift;
    my $dp = '';
    for ( my $i = 0; $i < length($ep); $i += 1 ) {
        my $char_p = substr( $ep, $i, 1 );
        if ( $char_p =~ /[a-z]/ ) {
            my $ord = ord($char_p);
            $ord -= 97;
            $ord += $nxseq[$i];
            $ord = $ord % 26;
            $ord += 97;
            $dp .= chr($ord);
        }
        elsif ( $char_p =~ /[A-Z]/ ) {
            my $ord = ord($char_p);
            $ord -= 65;
            $ord += $nxseq[$i];
            $ord = $ord % 26;
            $ord += 65;
            $dp .= chr($ord);
        }
        else {
            $dp .= $char_p;
        }
    }
    return $dp;
}

sub decrypt_nxos7 {
    my $ep = shift;
    my $dp = '';
    for ( my $i = 0; $i < length($ep); $i += 1 ) {
        my $char_p = substr( $ep, $i, 1 );
        if ( $char_p =~ /[a-z]/ ) {
            my $ord = ord($char_p);
            $ord -= 97;
            $ord -= $nxseq[$i];
            $ord += 26 if ( $ord < 0 );
            $ord += 97;
            $dp .= chr($ord);
        }
        elsif ( $char_p =~ /[A-Z]/ ) {
            my $ord = ord($char_p);
            $ord -= 65;
            $ord -= $nxseq[$i];
            $ord += 26 if ( $ord < 0 );
            $ord += 65;
            $dp .= chr($ord);
        }
        else {
            $dp .= $char_p;
        }
    }
    return $dp;
}
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.