Change unprotected netconf address from 0.0.0.0 to 127.0.0.1 . 66/5066/1
authorTomas Olvecky <tolvecky@cisco.com>
Fri, 31 Jan 2014 14:13:40 +0000 (15:13 +0100)
committerTomas Olvecky <tolvecky@cisco.com>
Fri, 31 Jan 2014 14:13:44 +0000 (15:13 +0100)
Plaintext netconf server was bound to any local interface. This is a security risk
because there is no authentication. The ssh server should be used as public endpoint instead.

Change-Id: I805ec065548e017dd2244d37e3275d379761e490
Signed-off-by: Tomas Olvecky <tolvecky@cisco.com>
opendaylight/distribution/opendaylight/src/main/resources/configuration/config.ini
opendaylight/netconf/netconf-util/src/main/java/org/opendaylight/controller/netconf/util/osgi/NetconfConfigUtil.java

index 47563b9..1ddfe1c 100644 (file)
@@ -13,7 +13,7 @@ osgi.bundles=\
     reference\:file\:../lib/jersey-server-1.17.jar@2:start
 
 # Netconf startup configuration
-netconf.tcp.address=0.0.0.0
+netconf.tcp.address=127.0.0.1
 netconf.tcp.port=8383
 
 netconf.tcp.client.address=127.0.0.1
index f2f0419..38563cb 100644 (file)
@@ -57,7 +57,12 @@ public class NetconfConfigUtil {
         if (inetSocketAddressOptional.isPresent() == false) {
             throw new IllegalStateException("Netconf tcp address not found." + exceptionMessageIfNotFound);
         }
-        return inetSocketAddressOptional.get();
+        InetSocketAddress inetSocketAddress = inetSocketAddressOptional.get();
+        if (inetSocketAddress.getAddress().isAnyLocalAddress()) {
+            logger.warn("Unprotected netconf TCP address is configured to ANY local address. This is a security risk. " +
+                    "Consider changing {} to 127.0.0.1", PREFIX_PROP + InfixProp.tcp + ADDRESS_SUFFIX_PROP);
+        }
+        return inetSocketAddress;
     }
 
     public static Optional<InetSocketAddress> extractSSHNetconfAddress(BundleContext context, String exceptionMessage) {