Session Log Masking in SSH Proxy

In some of the usage scenarios of SSH Proxy, sensitive data can be used in the commands on the connected device. If it is necessary to hide such sensitive data from the logs, the nsso.cli.secret_masking_pattern property key must be defined on the corresponding element type. Part of the command that would contain sensitive data should be written as $$value$$ at the property key with regular expression.

Property key definition:

nsso.cli.secret_masking_pattern = sshpass -v -p "$$value$$" ssh .*

CLI Input:

sshpass -v -p "Password1" ssh [email protected]

Session and Command Log lines at Kron PAM:

sshpass -v -p "*****" ssh [email protected]