nav icon indicating copy to clipboard operation
nav copied to clipboard

Make TLS certification validation configurable in the ipdevpoll Palo Alto ARP plugin

Open lunkwill42 opened this issue 9 months ago • 0 comments

Is your feature request related to a problem? Please describe.

The initial implementation of the plugin in #2613 ignores all TLS certificates by hardcoded default. This practice is very bad from a security standpoint.

Describe the solution you'd like

Really, the default should always be to verify. Options to disable verification, or to pin to a specific certificate should be added to ipdevpoll.conf. However, pinned certificates could be different for each firewall, which would require an equally stupid mechanism to pin a certificate for each Palo Alto IP device. The latter we might instead want to store as a custom attribute of the Netbox itself, and just a config option in ipdevpoll.conf to tell the plugin to use that whenever present?

Describe alternatives you've considered

Leave things as they are.

lunkwill42 avatar May 02 '24 11:05 lunkwill42