Accounting

These scenarios show accounting feature when secure mode is enabled. All logs are stored in file: running://log/user/audit_file/audit_file

File Logs

Description

Show different logs stored in audit file

Scenario

Step 1: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

Secure mode started

Step 2: Run command show running at DUT0 and expect this output:

Step 3: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

User 'admin' executed a new command: 'show running'

Step 4: Set the following configuration in DUT0:

set system cli configuration logging cli info
set system login user admin authentication encrypted-password '$6$45KRumJ9KvFuB0LX$URYVKd6adMPg1Z42CEXEIxVSyW3gBGkY75Vd0ZXkVJ50iPA2U1GE7oaIFRQgCgru4HSRx8bnQzQVIvjx6bahj.'
set system security medium

Step 5: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

User 'admin' committed the configuration

Hidden Passwords

Description

Plain passwords are not displayed

Scenario

Step 1: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.215.168.64/24
set system aaa server tacacs TAC1 address 10.215.168.1
set system aaa server tacacs TAC1 encrypted-key U2FsdGVkX1++Zmp3OhI+EpGoM3oYRvo97vzeWrwZltc=
set system login user admin authentication encrypted-password '$6$uUIKsUZoI48av62D$p5RDqU0aMesJVX/nlWN6OO/wQHslvu87UTVBzs92BtOo2YW8RnQE7xXVXaGVJmUZWC.jWM8/iSiBuVugbPIB4.'
set system security medium

Step 2: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

User 'admin' added a new cfg line: 'set system aaa server tacacs TAC1 key ******'

Audit file permissions

Description

Non admin user is allowed to open audit file

Scenario

Step 1: Set the following configuration in DUT0:

set system login role cfg level 10
set system login user admin authentication encrypted-password '$6$aSlFOMKItYpILf7.$AEOMVzRP1dcB8Rszt5V2j0h57urycUM72iqSjzzB.PuIgl.bXyL.L9IS7ljPbqQ1ai3N8N9jUQsemer6eocYV1'
set system login user test authentication encrypted-password '$6$dM.gzOHM1m2rUBE7$MjsqThqZGqB/D3kdXW.xvc3ZaOMKQIiUlNAxNxLQXEvfhAy.fiPn0DiXSgOSe/fsDq62JrndaKaEreo/YDEJp/'
set system login user test role cfg
set system security medium

Step 2: Login as test with password tEst!2qqqqqq

Step 3: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

Permission denied