From 2341e076a8fe6c979d4befd621501d46b1edef4c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mattias=20Walstr=C3=B6m?= <lazzer@gmail.com>
Date: Tue, 1 Oct 2024 11:10:18 +0200
Subject: [PATCH] factory-config: Add default NACM deny rule for reading
 password hash

This fix #499
---
 src/confd/share/factory.d/10-nacm.json | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/src/confd/share/factory.d/10-nacm.json b/src/confd/share/factory.d/10-nacm.json
index 39748814..49583a20 100644
--- a/src/confd/share/factory.d/10-nacm.json
+++ b/src/confd/share/factory.d/10-nacm.json
@@ -1,5 +1,6 @@
 {
     "ietf-netconf-acm:nacm": {
+	"enable-nacm": true,
 	"groups": {
 	    "group": [
 		{
@@ -25,6 +26,19 @@
 			"comment": "Allow 'admin' group complete access to all operations and data."
 		    }
 		]
+	    },
+	    {
+		"name": "default-deny-all",
+		"group": ["*"],
+		"rule": [
+		    {
+			"name":  "deny-password-read",
+			"module-name": "ietf-system",
+			"path": "/ietf-system:system/authentication/user/password",
+			"access-operations": "*",
+			"action": "deny"
+		    }
+		]
 	    }
 	]
     }