Forum Discussion

Wchen's avatar
Wchen
Icon for Nimbostratus rankNimbostratus
Jul 18, 2017

Signed iRule to allow execution of disabled commands?

Hi,

 

I'm trying to create an iRule that will call a custom shell script. However, the "exec" command has been disabled for security purposes. Is there a way to allow disabled commands that have been disabled to run if the iRule has been digitally signed?

 

The idea is that the first time a user attempts to log-in, they are given the opportunity to setup TFA if they belong to a particular group. They are then presented with the QR_CODE to setup their TFA, but I need to write the TFA Secret to a local file, so that it can be referenced in the F5 via iFile.

 

iRules
security

1 Reply

Sort By
  • samstep's avatar
    samstep
    Icon for Cirrocumulus rankCirrocumulus
    Jul 21, 2017

    There is no way to run 'exec' from an iRule - that would mean Remote Code Execution vulnerability and performance issues among other considerations why F5 has disabled this and several other commands in TCL.

     

    Digitally signed iRules do not magically enable disabled TCL commands at all - they just allow you to verify the authors of the iRule and that nobody has tampered with the iRule code.

     

    Also there is no way to create/write/modify an iFile from an iRule. You can only read iFiles (actually they are read by TMM into memory on boot or on iFile creation)

     

    Do you really need to write the secret on disk? A better approach would be to store it in a memory table using the 'table' command:

     

    https://devcentral.f5.com/wiki/irules.table.ashx