Accounting

These scenarios show accounting feature when secure mode is enabled. All logs are stored in file: running://log/user/audit_file/audit_file

File Logs

Description

Show different logs stored in audit file

Scenario

Step 1: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

Secure mode started

Step 2: Run command show running at DUT0 and expect this output:

Step 3: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

User 'admin' executed a new command: 'show running'

Step 4: Set the following configuration in DUT0:

set system cli configuration logging cli info
set system login user admin authentication encrypted-password '$6$INnI4e88s0Xq1v9h$X9YAbVQddt5qtXy2gleHTaZM/t2hKIQ.Ryu9QGT8eB00xPXXVvNOdAmbOT4arO8eK.ZwOuGrVfSMxzAkUgFfJ.'
set system security medium

Step 5: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

User 'admin' committed the configuration

Hidden Passwords

Description

Plain passwords are not displayed

Scenario

Step 1: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.215.168.64/24
set system aaa server tacacs TAC1 address 10.215.168.1
set system aaa server tacacs TAC1 encrypted-key U2FsdGVkX18HJMq2JrDZKGy8eWq3zzg9c8J1qlwsiGU=
set system login user admin authentication encrypted-password '$6$NLlk4/D0fmeLS4sI$TEp1GkcK4990.Tj7Y1e0Qu4rE6VdozOiXdZfGX3L6qIlqlsYiXsjWIUHsQ9nYJ2bXqo5WuvIZ0FT4EpArhv74/'
set system security medium

Step 2: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

User 'admin' added a new cfg line: 'set system aaa server tacacs TAC1 key ******'

Audit file permissions

Description

Non admin user is allowed to open audit file

Scenario

Step 1: Set the following configuration in DUT0:

set system login role cfg level 10
set system login user admin authentication encrypted-password '$6$RrZLd9URlW/NP68d$sY0fqCOLiTQMHVEmmvcli7E71s2qj.dMcugnzLtDfFynN9jZZCkyNdf4ztGPxAnDEIbbxCbOpKoVZMyKxsCkA0'
set system login user test authentication encrypted-password '$6$YhZZbMJ230aKZTkB$6zO4jHpq/m7Isb6XBAT6VfUMOC2WdfUdZogV3TtCIEH0JEF0QbMYHwtdP8oj1Sez.uc2pQy1Mr6fSI7B4Cuq71'
set system login user test role cfg
set system security medium

Step 2: Login as test with password tEst!2qqqqqq

Step 3: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

Permission denied