crypto_RSA_OAEP: encrypt/decrypt strings with asymmetric RSA keys, using PKCS#1 OAEP, an asymmetric cipher based on RSA and the OAEP padding
ldapPasswordHash: generate LDAP hashes of specified formats from a clear text password string
regex_search: search in a string to extract the part that matches the specified regular expression
This plugin allows to encrypt/decrypt strings with asymmetric RSA keys, using PKCS#1 OAEP, an asymmetric cipher based on RSA and the OAEP padding.
You can set up as many keys as you want in plugin settings. A key can be used to either encrypt or decrypt, but not both. The plugin will determine if it’s an encryption or a decryption operation upon the key type: decryption for private keys, and encryption for public keys.
hermes:
plugins:
attributes:
crypto_RSA_OAEP:
settings:
keys:
# Key name, you can set whatever you want
encrypt_to_messagebus:
# Hash type, when decrypting, you must obviously use the same value
# that was used for encrypting
hash: SHA3_512
# Public RSA key used to encrypt
# WARNING - THIS KEY IS WEAK AND PUBLIC, NEVER USE IT
rsa_key: |-
-----BEGIN PUBLIC KEY-----
MCgCIQCy2W1bAPOa1JIeLuV8qq1Qg7h0jxpf8QCik11H9xZcfwIDAQAB
-----END PUBLIC KEY-----
# Another key
decrypt_from_messagebus:
hash: SHA3_512
# Private RSA key used to decrypt
# WARNING - THIS KEY IS WEAK AND PUBLIC, NEVER USE IT
rsa_key: |-
-----BEGIN RSA PRIVATE KEY-----
MIGrAgEAAiEAstltWwDzmtSSHi7lfKqtUIO4dI8aX/EAopNdR/cWXH8CAwEAAQIh
AKfflFjGNOJQwvJX3Io+/juxO+HFd7SRC++zBD9paZqZAhEA5OtjZQUapRrV/aC5
NXFsswIRAMgBtgpz+t0FxyEXdzlcTwUCEHU6WZ8M2xU7xePpH49Ps2MCEQC+78s+
/WvfNtXcRI+gJfyVAhAjcIWzHC5q4wzgL7psbPGy
-----END RSA PRIVATE KEY----- Valid values for hash are:
crypto_RSA_OAEP(value: bytes | str, keyname: str) → strOnce everything is set up, you can encrypt data with encrypt_to_messagebus key like this in a Jinja filter:
password_encrypted: "{{ PASSWORD_CLEAR | crypto_RSA_OAEP('encrypt_to_messagebus') }}"
password_decrypted: "{{ PASSWORD_ENCRYPTED | crypto_RSA_OAEP('decrypt_from_messagebus') }}"You can even decrypt and immediately re-encrypt data with another key like this:
password_reencrypted: "{{ PASSWORD_ENCRYPTED | crypto_RSA_OAEP('decrypt_from_datasource') | crypto_RSA_OAEP('encrypt_to_messagebus') }}"This plugin allows to generate LDAP hashes of specified formats from a clear text password string.
You can set up a facultative list of default hash types in plugin settings. This list will be used if hashtypes are not specified in filter arguments, otherwise the specified hashtypes will be used.
hermes:
plugins:
attributes:
ldapPasswordHash:
settings:
default_hash_types:
- SMD5
- SSHA
- SSHA256
- SSHA512Valid values for default_hash_types are:
ldapPasswordHash(password: str, hashtypes: None | str | list[str] = None) → list[str]Once everything is set up, you can generate your hash list like this in a Jinja filter:
# Will contain a list of hashes of PASSWORD_CLEAR according to
# default_hash_types settings: SMD5, SSHA, SSHA256, SSHA512
ldap_password_hashes: "{{ PASSWORD_CLEAR | ldapPasswordHash }}"
# Will contain a list with only the SSHA512 hashes of PASSWORD_CLEAR
ldap_password_hashes: "{{ PASSWORD_CLEAR | ldapPasswordHash('SSHA512') }}"
# Will contain a list with only the SSHA256 and SSHA512 hashes of PASSWORD_CLEAR
ldap_password_hashes: "{{ PASSWORD_CLEAR | ldapPasswordHash(['SSHA256', 'SSHA512']) }}"This plugin allows to search in a string to extract the part that matches the specified regular expression.
Nothing to configure for the plugin.
hermes:
plugins:
attributes:
regex_search:regex_search(string: str, regex: str, multiline=False, ignorecase=False) → list[str] | NoneAs this plugin is just an adaptation of Ansible’s regex_search_filter, you can also check its documentation.
# Will be unset (contains None)
regex_results: "{{ 'foo' | regex_search('bar') }}"
# Will be unset (contains None)
regex_results: "{{ 'foobar' | regex_search('foo$') }}"
# Will contain 'foo'
regex_results: "{{ 'foobar' | regex_search('^foo') }}"
# Will contain 'foobar'
regex_results: "{{ 'foobar' | regex_search('^foo.*$') }}"
# Below is a more complex approach, where LDAP_PASSWORD_HASHES is a list of LDAP password hashes:
# LDAP_PASSWORD_HASHES:
# - "{SMD5}NGnIxNg+ZqB3XwhQK/jCRDWWpUQYVbwg"
# - "{SSHA}9u8ZbEbeLPLI2f4isG7YjJsz6sfonjQAfbbadQ=="
# - "{SSHA256}l0rZ10MhH6jKGogg2qFvCdiNAqkKVH9OuL0R3FgWRrV4mIaYM2cnYQ=="
# - "{SSHA512}zKR46tmGg0NKq1FdkmLGZCqXqfnApvFRHSTW4H0Sem9zJH66mgZ6/aB/aypGX+dLAI02akd9lZbplX6y0Typzzir8RIKh6cw,"
# Will contain ['{SSHA}9u8ZbEbeLPLI2f4isG7YjJsz6sfonjQAfbbadQ==']
regex_results: "{{ LDAP_PASSWORD_HASHES | map('regex_search', '^{SSHA}.*$') | reject('none') | list }}"
# Will contain ['{SSHA}9u8ZbEbeLPLI2f4isG7YjJsz6sfonjQAfbbadQ==', '{SSHA512}zKR46tmGg0NKq1FdkmLGZCqXqfnApvFRHSTW4H0Sem9zJH66mgZ6/aB/aypGX+dLAI02akd9lZbplX6y0Typzzir8RIKh6cw,']
regex_results: "{{ LDAP_PASSWORD_HASHES | map('regex_search', '^({SSHA}|{SSHA512}).*$') | reject('none') | list }}"