CloudLabBox
Try the free demo

Network automation lab 17 of 27

Secure automation: secrets, input validation and CA-signed TLS

Fix three classic automation security failures on real routers: a password leaked in code and Git history (rotate it and store secrets properly), a self-service script that lets anyone inject IOS commands (exploit it, then fix it with allow-list validation), and a REST client that skips certificate checks (build a lab CA and deploy a CA-signed certificate to IOS XE).

Run this lab

It needs Lite: its 3 nodes are set to 3 vCPU and 5,632 MB in total. That fits the free demo too.

In your workspace: Shared, then Network Automation - CCNA and CCNP Automation guided labs, then 17 - Secure automation - secrets input validation and CA-signed TLS

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 85 minutes
Nodes need
3 vCPU, 5,632 MB
Smallest plan
Lite

The scenario

An internal audit of Kestrel Freight's automation found three problems. A nightly backup script logs in to r1 with a password written into the code, and a colleague "removed" it from the team's repository. The new self-service portal lets staff set interface descriptions on r1, and nobody checked what it does with their input. And every REST client talks to the IOS XE router xe1 with certificate checks turned off. You'll prove each problem is real, fix it, and leave evidence that the fix works.

DeviceAddressNotes
devbox10.10.20.10~/lab: legacy_backup.py, legacy-repo/, self_service.py
r1 (IOS 15.9)10.10.20.11has a local user backup used by the backup script
xe1 (IOS XE 17.3)10.10.20.21RESTCONF on HTTPS with its own self-signed certificate

Your administrator login is netops / NetOps-Lab1 ($NET_USER, $NET_PASS).

What you’ll practise

  • Find secrets in code and Git history, rotate a leaked credential and keep secrets out of code
  • Exploit and fix a command-injection flaw with strict allow-list input validation
  • Relate the flaws to the OWASP top risks (injection, broken authentication, sensitive data exposure)
  • Build a lab CA, issue a server certificate with the right subject alternative names and deploy it to IOS XE
  • Call RESTCONF with full certificate verification from curl and Python

The tasks

  1. Find the leaked secret, in the code and in history
  2. Rotate the credential
  3. Keep secrets out of code
  4. Exploit the self-service script
  5. Fix it with allow-list validation
  6. See what verify=False really means
  7. Issue xe1 a certificate from your own CA
  8. Deploy the certificate and verify properly

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Secure automation - secrets input validation and CA-signed TLS3 nodes and 1 network, 3 links. Every link is listed as text below the diagram.devboxr1xe1Mgmteth0Gi0/0Gi1
3 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • devbox eth0 to Mgmt (network)
  • r1 Gi0/0 to Mgmt (network)
  • xe1 Gi1 to Mgmt (network)
Nodes in Secure automation: secrets, input validation and CA-signed TLS, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
devboxEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
r1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
xe1Cisco CSR 1000vcsr1000vng-universalk9.17.03.08a-serial1 vCPU, 4,096 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Network Automation - CCNA and CCNP Automation guided labs.

  3. Open 17 - Secure automation - secrets input validation and CA-signed TLS and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Network automation labs

All Network automation labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.