•  When using event options to export config during commit through a non-root or non super-user privilege user , the imported config file shows hashed password instead of "/*Secret Data*/" .

Example: 

Below is the configuration of Event options on the switch:

root@switch> show configuration event-options

policy backup-config {

  events ui_commit_completed;

  then {

    execute-commands {

      commands {

        "show configuration | display set";

        "show system commit";

      }

      user-name test;

      output-filename backup-config-git;

      destination backup-config {

        retry-count 3 retry-interval 10;

      }

    }

  }

}

destinations {

  backup-config {

    archive-sites {

      "scp://labroot:[email protected]:/var/tmp/";

    }

  }

}

Configuration of User:

The user test is configured under class test123 with limited privileges:

set system login class test123 permissions floppy

set system login class test123 allow-commands-regexps "file list"

set system login class test123 allow-commands-regexps "show configuration"

set system login class test123 allow-commands-regexps "show interfaces"

set system login class test123 allow-commands-regexps "file checksum"

set system login class test123 allow-commands-regexps "show system"

set system login class test123 allow-commands-regexps "show chassis"

set system login class test123 allow-commands-regexps "show version"

set system login class test123 allow-commands-regexps "show lacp"

set system login class test123 allow-commands-regexps "show firewall"

set system login class test123 deny-commands-regexps request

set system login class test123 deny-commands-regexps test

set system login class test123 deny-commands-regexps set

set system login class test123 deny-commands-regexps save

set system login class test123 deny-commands-regexps load

set system login class test123 deny-commands-regexps op

set system login class test123 deny-commands-regexps start

set system login class test123 deny-commands-regexps configure

set system login class test123 allow-configuration-regexps .*

set system login user test uid 2000

set system login user test class test123

The configuration explicitly mentions to execute the event using the user " test" but instead, the configurations were being executed and exported using the root user.

On the exported configuration encrypted password is seen instead of /* SECRET-DATA*/,:

set version 23.4R2-S4.11-EVO

set groups default system host-name jtac-qfx5130-32cd-r2009

set groups default system root-authentication encrypted-password "$1$u0szc6EF$XbsAoAH1t7nU4crY44IE5/" >> encrypted password is seen instead of /* SECRET-DATA*/,

set groups default system login user labroot uid 2012

set groups default system login user labroot class super-user

set groups default system login user labroot authentication encrypted-password "$1$UqJVsoLz$/OWul.ScGD975hOteWfsz0" >> encrypted password is seen instead of /* SECRET-DATA*/,

set groups default system syslog archive size 10m

This issue is specific to Junos EVO devices.

The issue will be resolved in 23.4R2-S9, 24.4R2-S5-EVO and subsequent releases.

After implementing the fix, the exported config file shows as expected

set version 23.4R2-S4.11-EVO

set groups default system host-name jtac-qfx5130-32cd-r2009

set groups default system root-authentication encrypted-password /* SECRET-DATA*/,

set groups default system login user labroot uid 2012

set groups default system login user labroot class super-user

set groups default system login user labroot authentication encrypted-password /* SECRET-DATA*/,

set groups default system syslog archive size 10m