Forum Discussion

ST_Wong's avatar
ST_Wong
Icon for Cirrus rankCirrus
Apr 19, 2018

Security of credentials in iControl/REST api

Hi all,

 

I'm newbie to iControl. It's useful and we hope to use it in daily provisioning, probably using python. However, we've to either use username/password or X-F5-Auth-Token which is not expected to have a 'too-long' lifetime (correct?).

 

We wonder if there is any good practice to avoid hard coding credentials (username/password) in any script, and if there is workaround to make use of X-F5-Auth-Token.

 

Would anyone please advise?

 

Thanks a lot. Regards

 

devops
iControlREST
LTM
Super-NetOps
  • Satoshi_Toyosa1's avatar
    Satoshi_Toyosa1
    Ret. Employee
    Apr 20, 2018

    The default token timeout is 20 min (1200s). You can make it shorter by patch-ing the timeout field if that's what you want. The sample below changes the timeout of the to 10s.

     

    curl -sk https://localhost/mgmt/shared/authz/tokens/ \
 -H "X-F5-Auth-Token: " -H "Content-type: applicaiton/json" \
 -X PATCH -d '{"timeout" : 10}'

    Or you can remove the token after you finish the task(s): e.g.,

     

    curl -sk https://localhost/mgmt/shared/authz/tokens/ -H "X-F5-Auth-Token: " \
 -X DELETE

    If you want to avoid a hard-coded user/pass pair in your code, why don't you make it prompt?

     

    >>> import sys
>>> user = sys.stdin.readline()
foo   <<< entered
>>> print(user)
foo