Random configuration analysis

Something funny happened recently. In the course of routine server maintenance, I discovered a bug with the nipper web front-end I had written for convenient configuration file auditing. When a text file is uploaded, it is temporarily written to disk so that the nipper executable can generate a pretty report. Ideally, the uploaded file is deleted even before the report is sent back to the requester. The line of code responsible for this action, however, has been silently failing to delete these files for the last year or so. As a result, I find myself with 2,184 random device configuration files submitted from all over the world.

If you've uploaded any sensitive or unsanitized configs to the parser (shame on you) you needn't worry; the configs are as good as deleted. However, I thought it might be interesting to do a half-assed (anonymous) analysis of what's been uploaded.

First, some statistics:

$ ls | wc -l
2184
$ du -sh .
71M .
$ ls -l | head -n 2
total 72008
-rw-r--r-- 1 stretch users   78281 Sep 14  2008 plnipper_20080914145016_PCykyD6m

That's 2,184 raw files (not necessarily valid configs) totaling 71 MB, the earliest of which is from 14 September 2008. After doing a spot-pruning of junk files (including tiny config bits, random terminal scripts, a copy of the cheat sheets zip archive someone was helpful enough to upload for safe keeping, and this), we're down to 2,147 files (65 MB).

So, what interesting numbers can we come up with?

Device types and versions:

$ grep -ire "^version 12.4" . | wc -l
538
$ grep -ire "^version 12.3" . | wc -l
174
$ grep -ire "^version 12.2" . | wc -l
551
$ grep -ire "^version 12.1" . | wc -l
134
$ grep -ire "^version 12.0" . | wc -l
48
$ grep -ire "^version 11" . | wc -l
8
$ grep -ire "#version" . | wc -l
9
$ grep -ire "^PIX Version" . | wc -l
90
$ grep -ire "ASA version" . | wc -l 
98

Plain text passwords:

$ grep -ire " password 0 " . | wc -l
178
$ grep -ire "^enable secret [^5]" . | wc -l
58

That's not too bad, but it indicates that the password-encryption service is disabled far more often than I would have thought.

$ grep -ire "^no service password-encryption$" . | wc -l
96

How about obfuscated (yet trivially reversed) passwords?

$ grep -ire " password 7 " . | wc -l
4099

Ouch. Of course some of these passwords have been prudently removed by a responsible human before the config was uploaded, but from reviewing the matched lines in full (versus just the count) I can verify that it is a very small minority.

Hoping these are lab devices:

$ grep -ire " password 0 cisco[0-9]*" . | wc -l
37
$ grep -ire "^enable secret cisco[0-9]*" . | wc -l
8

Legacy passwords only:

$ grep -ire "^no aaa new-model" . | wc -l
503

Well-known SNMP communities:

$ grep -ire "^snmp-server community public " . | wc -l
138
$ grep -ire "^snmp-server community private " . | wc -l
39
$ grep -ire "^snmp-server community public RO$" . | wc -l
27
$ grep -ire "^snmp-server community private RW$" . | wc -l
3

Seriously guys?

IPv6 (I was really hoping these would be higher):

$ grep -ire "^ipv6 unicast-routing" . | wc -l
22
$ grep -ire " ipv6 address " . | wc -l
138

Routing protocols:

$ grep -ire "^router rip" . | wc -l
123
$ grep -ire "^router eigrp" . | wc -l
312
$ grep -ire "^router ospf" . | wc -l
401
$ grep -ire "^router isis" . | wc -l
22
$ grep -ire "^router bgp" . | wc -l
202

Telnet and SSH:

$ grep -ire "transport input telnet" . | wc -l
590
$ grep -ire "transport input ssh" . | wc -l
611
$ grep -ire "transport input all" . | wc -l
133

And finally, by far the most shockingly low count:

$ grep -ire "fuck" . | wc -l
1

If anyone has any other suggestions for interesting numbers before I delete archive, be sure to mention them in a comment.