Legrand / Raritan / Server Technology Xerus™ JSON-RPC API

Loading...
Searching...
No Matches
Security.idl
1/* SPDX-License-Identifier: BSD-3-Clause */
2/*
3 * Copyright 2009 Raritan Inc. All rights reserved.
4 */
5
6#include <UserEvent.idl>
7
8/**
9 * %Security Configuration
10 */
11module security {
12
13 /** IP packet filter policy */
14 enumeration IpfwPolicy {
15 ACCEPT, ///< Accept the packet
16 DROP, ///< Silently discard the packet
17 REJECT ///< Discard packet, send error response
18 };
19
20 /** IP packet filter rule */
21 structure IpfwRule {
22 string ipMask; ///< Remote IP and network mask
23 IpfwPolicy policy; ///< Filter policy
24 };
25
26 /** IP packet filter configuration */
27 structure IpFw {
28 boolean enabled; ///< \c true to enable packet filtering
29 IpfwPolicy defaultPolicyIn; ///< The default policy for inbound traffic in case no rule matches
30 IpfwPolicy defaultPolicyOut; ///< The default policy for outbound traffic in case no rule matches
31 vector<IpfwRule> ruleSetIn; ///< Ordered list of inbound firewall rules
32 vector<IpfwRule> ruleSetOut; ///< Ordered list of outbound firewall rules
33 };
34
35 /** Role-based access policy */
36 enumeration RoleAccessPolicy {
37 ALLOW, ///< Access granted
38 DENY ///< Access denied
39 };
40
41 /** Role-based access rule */
42 structure RoleAccessRule {
43 string startIp; ///< Start of IP range
44 string endIp; ///< End of IP range
45 int roleId; ///< Role id
46 RoleAccessPolicy policy; ///< Access policy
47 };
48
49 /** Role-based access control settings */
50 structure RoleAccessControl {
51 boolean enabled; ///< \c true to enable role-based access control
52 RoleAccessPolicy defaultPolicy; ///< Default policy
53 vector<RoleAccessRule> rules; ///< List of access rules
54 };
55
56 /** User blocking settings */
57 structure BlockSettings {
58 int maxFailedLogins; ///< The number of failed logins before blocking a user
59 int blockTimeout; ///< Time (in minutes) the account will be blocked
60 int failedLoginTimeout; ///< Time (in minutes) before resetting the failure counter
61 };
62
63 /** Password settings */
64 structure PasswordSettings {
65 boolean enableAging; ///< \c true to enable password aging
66 int agingInterval; ///< Aging interval in days
67 boolean enableStrongReq; ///< \c true to enable strong password requirements
68 int minPwLength; ///< Minimum password length
69 int maxPwLength; ///< Maximum password length
70 boolean enforceLower; ///< Passwords must contain at least one lower case character
71 boolean enforceUpper; ///< Passwords must contain at least one upper case character
72 boolean enforceNumeric; ///< Passwords must contain at least one numeric character
73 boolean enforceSpecial; ///< Passwords must contain at least one special character
74 int pwHistoryDepth; ///< Number of entries in password history
75 };
76
77 /** SSH authentication settings */
78 structure SSHSettings {
79 boolean allowPasswordAuth; ///< Allow password authentication
80 boolean allowPublicKeyAuth; ///< Allow public key authentication
81 };
82
83 /** Type of SSH host key */
84 enumeration SSHHostKeyType {
85 SSH_HOST_KEY_TYPE_RSA,
86 SSH_HOST_KEY_TYPE_ECDSA,
87 SSH_HOST_KEY_TYPE_ED25519
88 };
89
90 /** Type of SSH key fingerprint */
91 enumeration SSHKeyFingerprintType {
92 SSH_KEY_FPRINT_TYPE_MD5_HEX,
93 SSH_KEY_FPRINT_TYPE_SHA256_BASE64,
94 SSH_KEY_FPRINT_TYPE_UNKNOWN
95 };
96
97 /** Fingerprints of SSH host key */
98 structure SSHKeyFingerprint {
99 string fingerprint; ///< Fingerprint of SSH key
100 SSHKeyFingerprintType type; ///< Type of fingerprint
101 };
102
103 /** SSH host keys */
104 structure SSHHostKey {
105 string key; ///< Public key
106 SSHHostKeyType type; ///< Type of public key
107 vector<SSHKeyFingerprint> fingerprints; ///< Fingerprints of public key
108 };
109
110 /** Restricted Service Agreement settings */
111 structure RestrictedServiceAgreement {
112 boolean enabled; ///< Enforce Restricted Service Agreement
113 string banner; ///< Restricted Service Agreement Banner
114 };
115
116 /** Information about Trusted Platform Module */
117 structure TpmInfo {
118 boolean detected;
119 };
120
121 /**
122 * This Event is emitted after any of the password-settings
123 * has been changed
124 */
125 valueobject PasswordSettingsChanged extends event.UserEvent {
126 PasswordSettings oldSettings;
127 PasswordSettings newSettings;
128 };
129
130 /**
131 * Front panel privileges have been changed
132 */
133 valueobject FrontPanelPrivilegesChanged extends event.UserEvent {
134 vector<string> oldPrivileges; ///< old front panel privileges
135 vector<string> newPrivileges; ///< new front panel privileges
136 };
137
138 /** %Security configuration interface */
139 interface Security {
140
141 constant int ERR_INVALID_VALUE = 1; ///< Invalid arguments
142
143 /**
144 * Retrieve the current state of the HTTP-to-HTTPS redirection.
145 *
146 * @return \c true if the HTTP-to-HTTPS redirection is enabled
147 */
148 boolean getHttpRedirSettings();
149
150 /**
151 * Enable or disable HTTP-to-HTTPS redirection.
152 *
153 * @param http2httpsRedir \c true to enable the redirection
154 */
155 void setHttpRedirSettings(in boolean http2httpsRedir);
156
157 /**
158 * Check whether HTTP Strict Transport Security (HSTS) is enabled
159 *
160 * @return \c true when HSTS is enabled
161 */
162 boolean isHstsEnabled();
163
164 /**
165 * Enable or disable HTTP Strict Transport Security (HSTS).
166 *
167 * @param enable \c true to enable HSTS
168 */
169 void setHstsEnabled(in boolean enable);
170
171 /**
172 * Retrieve the IPv4 packet filter configuration.
173 *
174 * @return %IPv4 packet filter configuration
175 */
176 IpFw getIpFwSettings();
177
178 /**
179 * Set the IPv4 packet filter configuration.
180 *
181 * @param ipFw New packet filter settings
182 *
183 * @return 0 on success
184 * @return ERR_INVALID_VALUE if any argument was invalid
185 */
186 int setIpFwSettings(in IpFw ipFw);
187
188 /**
189 * Retrieve the IPv6 packet filter configuration.
190 *
191 * @return %IPv6 packet filter configuration
192 */
193 IpFw getIpV6FwSettings();
194
195 /**
196 * Set the IPv6 packet filter configuration.
197 *
198 * @param ipV6Fw New packet filter settings
199 *
200 * @return 0 on success
201 * @return ERR_INVALID_VALUE if any argument was invalid
202 */
203 int setIpV6FwSettings(in IpFw ipV6Fw);
204
205 /**
206 * Retrieve the role-base access control settings for IPv4.
207 *
208 * @return Role-based access control settings
209 */
210 RoleAccessControl getRoleAccessControlSettings();
211
212 /**
213 * Change the role-based access control settings.
214 *
215 * @param settings New settings
216 *
217 * @return 0 on success
218 * @return ERR_INVALID_VALUE if any argument was invalid
219 */
220 int setRoleAccessControlSettings(in RoleAccessControl settings);
221
222 /**
223 * Retrieve the role-base access control settings for IPv6.
224 *
225 * @return Role-based access control settings
226 */
227 RoleAccessControl getRoleAccessControlSettingsV6();
228
229 /**
230 * Change the role-based access control settings for IPv6.
231 *
232 * @param settings New settings
233 *
234 * @return 0 on success
235 * @return ERR_INVALID_VALUE if any argument was invalid
236 */
237 int setRoleAccessControlSettingsV6(in RoleAccessControl settings);
238
239 /**
240 * Retrieve the current user blocking settings
241 *
242 * @return User blocking settings
243 */
244 BlockSettings getBlockSettings();
245
246 /**
247 * Change the user blocking settings.
248 *
249 * @param settings New settings
250 *
251 * @return 0 on success
252 * @return ERR_INVALID_VALUE if any argument was invalid
253 */
254 int setBlockSettings(in BlockSettings settings);
255
256 /**
257 * Retrieve the password settings.
258 *
259 * @return Password settings
260 */
261 PasswordSettings getPwSettings();
262
263 /**
264 * Change the password settings.
265 *
266 * @param pwSettings New settings
267 *
268 * @return 0 on success
269 * @return ERR_INVALID_VALUE if any argument was invalid
270 */
271 int setPwSettings(in PasswordSettings pwSettings);
272
273 /**
274 * Retrieve the current idle timeout.
275 *
276 * @return Idle timeout in minutes
277 */
278 int getIdleTimeoutSettings();
279
280 /**
281 * Change the session idle timeout.
282 *
283 * @param idleTimeout New idle timeout in minutes
284 *
285 * @return 0 on success
286 * @return ERR_INVALID_VALUE if any argument was invalid
287 */
288 int setIdleTimeoutSettings(in int idleTimeout);
289
290 /**
291 * Retrieve the current single-login limitation setting.
292 *
293 * @return \c true if single-login limitation is enabled
294 */
295 boolean getSingleLoginLimitation();
296
297 /**
298 * Enable or disable single login limitation.
299 *
300 * @param singleLogin \c true to enable single login limitation
301 */
302 void setSingleLoginLimitation(in boolean singleLogin);
303
304 /**
305 * Retrieve the current SSH settings
306 *
307 * @return SSH settings
308 */
309 SSHSettings getSSHSettings();
310
311 /**
312 * Change the SSH settings
313 *
314 * @param settings New settings
315 */
316 void setSSHSettings(in SSHSettings settings);
317
318 /**
319 * Retrieve the host SSH keys
320 *
321 * @return SSH host keys
322 */
323 vector<SSHHostKey> getSSHHostKeys();
324
325 /**
326 * Retrieve the current Restricted Service Agreement settings
327 *
328 * @return Restricted Service Agreement settings
329 */
330 RestrictedServiceAgreement getRestrictedServiceAgreement();
331
332 /**
333 * Change the Restricted Service Agreement settings
334 *
335 * @param settings New settings
336 *
337 * @return 0 on success
338 * @return ERR_INVALID_VALUE if any argument was invalid
339 */
340 int setRestrictedServiceAgreement(in RestrictedServiceAgreement settings);
341
342 /**
343 * Retrieve a list of supported privileges for the front panel
344 *
345 * @return List of privilege names
346 */
347 vector<string> getSupportedFrontPanelPrivileges();
348
349 /**
350 * Retrieve the list of active front panel privileges
351 *
352 * @return List of privilege names
353 */
354 vector<string> getFrontPanelPrivileges();
355
356 /**
357 * Set the privileges for the front panel
358 *
359 * @return 0 on success
360 * @return ERR_INVALID_VALUE if any argument was invalid
361 */
362 int setFrontPanelPrivileges(in vector<string> privileges);
363
364 /**
365 * Set the default admin account password and optionally disable strong password requirements.
366 *
367 * The purpose of this method is to set the default admin account password when the device is
368 * unprovisioned, i.e. has not been configured yet or has been reset to factory defaults. The
369 * difference to the regular setAccountPassword() method in the User.idl is that this method
370 * allows to disable the strong password requirements at the same time. It allows choosing a
371 * weaker password in case strong password requirements are not needed for the specific purpose.
372 *
373 * @param password The new password
374 * @param disableStrongPasswordReq \c true to disable strong password requirements
375 * \c false to keep the current strong password requirement setting
376 *
377 * @return 0 OK
378 * @return 1 The new password has to differ from old password.
379 * @return 2 The password must not be empty.
380 * @return 3 The password is too short.
381 * @return 4 The password is too long.
382 * @return 5 The password must not contain control characters.
383 * @return 6 The password has to contain at least one lower case character.
384 * @return 7 The password has to contain at least one upper case character.
385 * @return 8 The password has to contain at least one numeric character.
386 * @return 9 The password has to contain at least one printable special character.
387 * @return 10 The password already is in history.
388 * @return 11 SNMPv3 USM is activated for the user and the password shall be used as auth passphrase.
389 * For this case, the password is too short (must be at least 8 characters).
390 */
391 int setDefaultAdminAccountPassword(in string password, in boolean disableStrongPasswordReq);
392
393 /**
394 * Check whether secure boot is active.
395 *
396 * ATTENTION: There are some uncertainties involved here. It is possible that it reports secure boot
397 * active while it isn't. Theoretically also the opposite is possible. For that reason
398 * the result of this function may not be used to reduce any security checks!
399 *
400 * @return \c true if secure boot is active
401 */
402 boolean isSecureBootActive();
403
404 /**
405 * Return information about an installed Trusted Platform Module (TPM).
406 *
407 * @return TPM information
408 */
409 TpmInfo getTpmInfo();
410
411 };
412
413}
security::Security
Security configuration interface
Definition Security.idl:139
security::Security::setIpV6FwSettings
int setIpV6FwSettings(in IpFw ipV6Fw)
Set the IPv6 packet filter configuration.
security::Security::getBlockSettings
BlockSettings getBlockSettings()
Retrieve the current user blocking settings.
security::Security::getHttpRedirSettings
boolean getHttpRedirSettings()
Retrieve the current state of the HTTP-to-HTTPS redirection.
security::Security::setSingleLoginLimitation
void setSingleLoginLimitation(in boolean singleLogin)
Enable or disable single login limitation.
security::Security::setRoleAccessControlSettingsV6
int setRoleAccessControlSettingsV6(in RoleAccessControl settings)
Change the role-based access control settings for IPv6.
security::Security::isHstsEnabled
boolean isHstsEnabled()
Check whether HTTP Strict Transport Security (HSTS) is enabled.
security::Security::getSingleLoginLimitation
boolean getSingleLoginLimitation()
Retrieve the current single-login limitation setting.
security::Security::setDefaultAdminAccountPassword
int setDefaultAdminAccountPassword(in string password, in boolean disableStrongPasswordReq)
Set the default admin account password and optionally disable strong password requirements.
security::Security::getTpmInfo
TpmInfo getTpmInfo()
Return information about an installed Trusted Platform Module (TPM).
security::Security::setHstsEnabled
void setHstsEnabled(in boolean enable)
Enable or disable HTTP Strict Transport Security (HSTS).
security::Security::getPwSettings
PasswordSettings getPwSettings()
Retrieve the password settings.
security::Security::getSupportedFrontPanelPrivileges
vector< string > getSupportedFrontPanelPrivileges()
Retrieve a list of supported privileges for the front panel.
security::Security::setIdleTimeoutSettings
int setIdleTimeoutSettings(in int idleTimeout)
Change the session idle timeout.
security::Security::getFrontPanelPrivileges
vector< string > getFrontPanelPrivileges()
Retrieve the list of active front panel privileges.
security::Security::setIpFwSettings
int setIpFwSettings(in IpFw ipFw)
Set the IPv4 packet filter configuration.
security::Security::setSSHSettings
void setSSHSettings(in SSHSettings settings)
Change the SSH settings.
security::Security::getSSHHostKeys
vector< SSHHostKey > getSSHHostKeys()
Retrieve the host SSH keys.
security::Security::getIpFwSettings
IpFw getIpFwSettings()
Retrieve the IPv4 packet filter configuration.
security::Security::getRoleAccessControlSettings
RoleAccessControl getRoleAccessControlSettings()
Retrieve the role-base access control settings for IPv4.
security::Security::isSecureBootActive
boolean isSecureBootActive()
Check whether secure boot is active.
security::Security::setHttpRedirSettings
void setHttpRedirSettings(in boolean http2httpsRedir)
Enable or disable HTTP-to-HTTPS redirection.
security::Security::setRestrictedServiceAgreement
int setRestrictedServiceAgreement(in RestrictedServiceAgreement settings)
Change the Restricted Service Agreement settings.
security::Security::setRoleAccessControlSettings
int setRoleAccessControlSettings(in RoleAccessControl settings)
Change the role-based access control settings.
security::Security::setPwSettings
int setPwSettings(in PasswordSettings pwSettings)
Change the password settings.
security::Security::getRoleAccessControlSettingsV6
RoleAccessControl getRoleAccessControlSettingsV6()
Retrieve the role-base access control settings for IPv6.
security::Security::getIdleTimeoutSettings
int getIdleTimeoutSettings()
Retrieve the current idle timeout.
security::Security::getIpV6FwSettings
IpFw getIpV6FwSettings()
Retrieve the IPv6 packet filter configuration.
security::Security::getSSHSettings
SSHSettings getSSHSettings()
Retrieve the current SSH settings.
security::Security::setFrontPanelPrivileges
int setFrontPanelPrivileges(in vector< string > privileges)
Set the privileges for the front panel.
security::Security::setBlockSettings
int setBlockSettings(in BlockSettings settings)
Change the user blocking settings.
security::Security::getRestrictedServiceAgreement
RestrictedServiceAgreement getRestrictedServiceAgreement()
Retrieve the current Restricted Service Agreement settings.
security
Security Configuration
Definition Security.idl:11
security::SSHHostKeyType
SSHHostKeyType
Type of SSH host key.
Definition Security.idl:84
security::RoleAccessPolicy
RoleAccessPolicy
Role-based access policy.
Definition Security.idl:36
security::DENY
@ DENY
Access denied.
Definition Security.idl:38
security::ALLOW
@ ALLOW
Access granted.
Definition Security.idl:37
security::IpfwPolicy
IpfwPolicy
IP packet filter policy.
Definition Security.idl:14
security::REJECT
@ REJECT
Discard packet, send error response.
Definition Security.idl:17
security::DROP
@ DROP
Silently discard the packet.
Definition Security.idl:16
security::ACCEPT
@ ACCEPT
Accept the packet.
Definition Security.idl:15
security::SSHKeyFingerprintType
SSHKeyFingerprintType
Type of SSH key fingerprint.
Definition Security.idl:91
security::BlockSettings
User blocking settings.
Definition Security.idl:57
security::BlockSettings::maxFailedLogins
int maxFailedLogins
The number of failed logins before blocking a user.
Definition Security.idl:58
security::BlockSettings::failedLoginTimeout
int failedLoginTimeout
Time (in minutes) before resetting the failure counter.
Definition Security.idl:60
security::BlockSettings::blockTimeout
int blockTimeout
Time (in minutes) the account will be blocked.
Definition Security.idl:59
security::FrontPanelPrivilegesChanged
Front panel privileges have been changed.
Definition Security.idl:133
security::FrontPanelPrivilegesChanged::oldPrivileges
vector< string > oldPrivileges
old front panel privileges
Definition Security.idl:134
security::FrontPanelPrivilegesChanged::newPrivileges
vector< string > newPrivileges
new front panel privileges
Definition Security.idl:135
security::IpFw
IP packet filter configuration.
Definition Security.idl:27
security::IpFw::enabled
boolean enabled
true to enable packet filtering
Definition Security.idl:28
security::IpFw::ruleSetOut
vector< IpfwRule > ruleSetOut
Ordered list of outbound firewall rules.
Definition Security.idl:32
security::IpFw::ruleSetIn
vector< IpfwRule > ruleSetIn
Ordered list of inbound firewall rules.
Definition Security.idl:31
security::IpFw::defaultPolicyIn
IpfwPolicy defaultPolicyIn
The default policy for inbound traffic in case no rule matches.
Definition Security.idl:29
security::IpFw::defaultPolicyOut
IpfwPolicy defaultPolicyOut
The default policy for outbound traffic in case no rule matches.
Definition Security.idl:30
security::IpfwRule
IP packet filter rule.
Definition Security.idl:21
security::IpfwRule::policy
IpfwPolicy policy
Filter policy.
Definition Security.idl:23
security::IpfwRule::ipMask
string ipMask
Remote IP and network mask.
Definition Security.idl:22
security::PasswordSettingsChanged
This Event is emitted after any of the password-settings has been changed.
Definition Security.idl:125
security::PasswordSettings
Password settings.
Definition Security.idl:64
security::PasswordSettings::enableStrongReq
boolean enableStrongReq
true to enable strong password requirements
Definition Security.idl:67
security::PasswordSettings::enableAging
boolean enableAging
true to enable password aging
Definition Security.idl:65
security::PasswordSettings::enforceSpecial
boolean enforceSpecial
Passwords must contain at least one special character.
Definition Security.idl:73
security::PasswordSettings::enforceNumeric
boolean enforceNumeric
Passwords must contain at least one numeric character.
Definition Security.idl:72
security::PasswordSettings::pwHistoryDepth
int pwHistoryDepth
Number of entries in password history.
Definition Security.idl:74
security::PasswordSettings::enforceUpper
boolean enforceUpper
Passwords must contain at least one upper case character.
Definition Security.idl:71
security::PasswordSettings::maxPwLength
int maxPwLength
Maximum password length.
Definition Security.idl:69
security::PasswordSettings::agingInterval
int agingInterval
Aging interval in days.
Definition Security.idl:66
security::PasswordSettings::enforceLower
boolean enforceLower
Passwords must contain at least one lower case character.
Definition Security.idl:70
security::PasswordSettings::minPwLength
int minPwLength
Minimum password length.
Definition Security.idl:68
security::RestrictedServiceAgreement
Restricted Service Agreement settings.
Definition Security.idl:111
security::RestrictedServiceAgreement::banner
string banner
Restricted Service Agreement Banner.
Definition Security.idl:113
security::RestrictedServiceAgreement::enabled
boolean enabled
Enforce Restricted Service Agreement.
Definition Security.idl:112
security::RoleAccessControl
Role-based access control settings.
Definition Security.idl:50
security::RoleAccessControl::defaultPolicy
RoleAccessPolicy defaultPolicy
Default policy.
Definition Security.idl:52
security::RoleAccessControl::enabled
boolean enabled
true to enable role-based access control
Definition Security.idl:51
security::RoleAccessControl::rules
vector< RoleAccessRule > rules
List of access rules.
Definition Security.idl:53
security::RoleAccessRule
Role-based access rule.
Definition Security.idl:42
security::RoleAccessRule::policy
RoleAccessPolicy policy
Access policy.
Definition Security.idl:46
security::RoleAccessRule::endIp
string endIp
End of IP range.
Definition Security.idl:44
security::RoleAccessRule::roleId
int roleId
Role id.
Definition Security.idl:45
security::RoleAccessRule::startIp
string startIp
Start of IP range.
Definition Security.idl:43
security::SSHHostKey
SSH host keys.
Definition Security.idl:104
security::SSHHostKey::key
string key
Public key.
Definition Security.idl:105
security::SSHHostKey::fingerprints
vector< SSHKeyFingerprint > fingerprints
Fingerprints of public key.
Definition Security.idl:107
security::SSHHostKey::type
SSHHostKeyType type
Type of public key.
Definition Security.idl:106
security::SSHKeyFingerprint
Fingerprints of SSH host key.
Definition Security.idl:98
security::SSHKeyFingerprint::type
SSHKeyFingerprintType type
Type of fingerprint.
Definition Security.idl:100
security::SSHKeyFingerprint::fingerprint
string fingerprint
Fingerprint of SSH key.
Definition Security.idl:99
security::SSHSettings
SSH authentication settings.
Definition Security.idl:78
security::SSHSettings::allowPasswordAuth
boolean allowPasswordAuth
Allow password authentication.
Definition Security.idl:79
security::SSHSettings::allowPublicKeyAuth
boolean allowPublicKeyAuth
Allow public key authentication.
Definition Security.idl:80
security::TpmInfo
Information about Trusted Platform Module.
Definition Security.idl:117