Fix IOS remote file copy credentials and report device copy errors

changes/429.changed

@@ -0,0 +1 @@
+Raised the minimum supported netmiko version to 4.4.

changes/429.fixed

@@ -0,0 +1 @@
+Fixed FTP, HTTP and HTTPS file transfers to Cisco IOS devices failing to authenticate.

changes/429.fixed.1

@@ -0,0 +1 @@
+Fixed remote file copy failures on Cisco IOS, NX-OS, ASA and IOS-XR reporting a generic message instead of the error the device returned.

changes/429.fixed.2

@@ -0,0 +1 @@
+Fixed remote file copy hanging on Cisco IOS and NX-OS when a device returned output the driver did not recognize.

changes/429.security

@@ -0,0 +1 @@
+Stopped the source server password appearing in the logs during an FTP, HTTP or HTTPS file copy to Cisco IOS devices.

docs/user/lib_getting_started.md

@@ -287,6 +287,17 @@ Before using this feature you may need to configure a client on the device. For
 >>>
 ```
 
+!!! warning
+    Some devices read the FTP, HTTP and HTTPS credentials from the `copy` command instead of prompting for them. On those devices the credentials are placed in the command sent to the device whether they come from the URL, such as `ftp://username:password@10.1.1.10/path/to/file.bin`, or from the `username` and `token` fields. The command can appear in the device's command history and in AAA command accounting. To keep the credentials off the session, configure them on the device and pass a URL without them, such as `ftp://10.1.1.10/path/to/file.bin`:
+
+    ```python
+    >>> csr1.config('ip ftp username ntc')
+    >>> csr1.config('ip ftp password ntc123')
+    >>>
+    ```
+
+    This impacts Cisco IOS, Cisco NX-OS, Arista EOS and Juniper Junos.
+
 ### Save Configs
 
 - `save` method

pyntc/devices/asa_device.py

@@ -1039,6 +1039,11 @@ def reboot_standby(self, acceptable_states: Optional[Iterable[str]] = None, time
 
         log.debug("Host %s: reboot standby with timeout %s.", self.host, timeout)
 
+    @staticmethod
+    def _mask_token(output: str, src: FileCopyModel) -> str:
+        """Replace the token in device output, so it is safe to log or raise."""
+        return output.replace(src.token, "*****") if src.token else output
+
     def remote_file_copy(self, src: FileCopyModel = None, dest=None, **kwargs: Any):
         """Copy a file from a remote server to the device.
 
@@ -1104,8 +1109,9 @@ def remote_file_copy(self, src: FileCopyModel = None, dest=None, **kwargs: Any):
                     break
 
                 if re.search(r"(Error|Invalid|Failed|Aborted|denied)", output, re.IGNORECASE):
-                    log.error("Host %s: File transfer error for %s: %s", self.host, src.file_name, output)
-                    raise FileTransferError
+                    masked_output = self._mask_token(output, src)
+                    log.error("Host %s: File transfer error for %s: %s", self.host, src.file_name, masked_output)
+                    raise FileTransferError(f"Error detected in copy command output: {masked_output}")
 
                 for prompt, answer in prompt_answers.items():
                     if re.search(prompt, output, re.IGNORECASE):
@@ -1117,16 +1123,22 @@ def remote_file_copy(self, src: FileCopyModel = None, dest=None, **kwargs: Any):
                         )
                         break
                 else:
+                    masked_output = self._mask_token(output, src)
                     log.error(
-                        "Host %s: Unexpected output during file transfer of %s: %s", self.host, src.file_name, output
+                        "Host %s: Unexpected output during file transfer of %s: %s",
+                        self.host,
+                        src.file_name,
+                        masked_output,
                     )
-                    raise FileTransferError
+                    raise FileTransferError(f"Unexpected output during file transfer: {masked_output}")
 
             if not self.verify_file(
                 src.checksum, dest, hashing_algorithm=src.hashing_algorithm, file_system=file_system
             ):
                 log.error("Host %s: File %s could not be verified after transfer.", self.host, src.file_name)
-                raise FileTransferError
+                raise FileTransferError(
+                    f"Could not validate {src.file_name} existed and matched the expected checksum after transfer."
+                )
 
     @property
     def redundancy_mode(self):