For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

matbel_119218's avatar
matbel_119218
Icon for Nimbostratus rankNimbostratus
Nov 11, 2013
Solved

APM 11.4.0 registry check with session variable

Hi Guys, I try use session variable in registry check, but it doesn't work. Example: "HKEY_LOCAL_MACHINE64\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"."DefaultUserName" = session.logon.last.username

 

How can I use the session variable?

 

Thanks, MatBel

 

BIG-IP Access Policy Manager (APM)
design
microsoft
security

4 Replies

  • Matt_Dierick's avatar
    Matt_Dierick
    Icon for Employee rankEmployee
    Nov 11, 2013

    I would try :

     

    "HKEY_LOCAL_MACHINE64\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"."DefaultUserName" = %{session.logon.last.username}

     

  • Lucas_Thompson_'s avatar
    Lucas_Thompson_
    Historic F5 Account
    Nov 11, 2013

    Unfortunately it's not possible to use session variables in the Registry Check. We encourage support tickets with enhancement requests though, please send one in. I was not able to locate an existing request for this feature, surprisingly.

     

    EDIT: Starting with 12.1 this feature is added to get a value from the registry and store it as a session variable. There are restrictions because it has potential security implications. See the following for more information:

     

    https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-visual-policy-editor-12-1-0/9.html

     

  • matbel_119218's avatar
    matbel_119218
    Icon for Nimbostratus rankNimbostratus
    Nov 12, 2013

    Thanks for the answers. Is there another way to read the registry key: iRule, TCL?

     

  • Alexander_Kova1's avatar
    Alexander_Kova1
    Historic F5 Account
    Mar 19, 2014

    As a workaround you can try to use "Variable Assign" action on ".config" variable.

    You can use:

    configdump -allkeys | grep check_registry

    to find exact variable (registry check expression) to replace.

    apm policy agent variable-assign ap1_act_variable_assign_ag {
    variables {
        {
            expression "return {%22HKEY_LOCAL_MACHINE64\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon%22.%22DefaultUserName%22 = %22%{session.logon.last.username}%22 }"
            varname config.windows_check_registry./Common/ap1_act_registry_check_ag.expression
        }
    }
}