Accounting

These scenarios show accounting feature when secure mode is enabled. All logs are stored in file: running://log/user/audit_file/audit_file

File Logs

Description

Show different logs stored in audit file

Scenario

Step 1: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

Secure mode started

Step 2: Run command show running at DUT0 and expect this output:

Step 3: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

User 'admin' executed a new command: 'show running'

Step 4: Set the following configuration in DUT0 :

set system cli configuration logging cli info
set system login user admin authentication encrypted-password '$6$tNpBZZ8fNWnu2Qz/$m8KhVt.sz267nh34xFo1PKFECo9Lyh2XH2yc.f.m2RrAyeMkvfHIY4OZslI/y2upCe4wbOB8m9/MBB1NK8Y7N.'
set system security medium

Step 5: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

User 'admin' committed the configuration

Hidden Passwords

Description

Plain passwords are not displayed

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set system aaa server tacacs TAC1 address 10.215.168.1
set system aaa server tacacs TAC1 encrypted-key U2FsdGVkX1+Ype6OEkUr8wynoEMxLA3i3xKwQTIHUTw=
set system login user admin authentication encrypted-password '$6$KWTsDurg.Z7eSOJk$lonwBlVl3u5Mvz5wLJN1UjDyS5.p7tQXZW9qQx4tc.BLxIPhYymeznVf25S3ctE.BIEKrEk4/wYl3nU5LRXym1'
set system security medium

Step 2: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

User 'admin' added a new cfg line: 'set system aaa server tacacs TAC1 key ******'

Audit file permissions

Description

Non admin user is allowed to open audit file

Scenario

Step 1: Set the following configuration in DUT0 :

set system login role cfg level 10
set system login user admin authentication encrypted-password '$6$Cmmpy/xAU.hSgFKa$w0Uf15TGILZlP.ODcUeRL.e9tAGu9GutjV07oMKK2ChV.oqwPVdkJOn/ftGIZ1iKGzlB5ZJZ8QlSVu3lD6kiU0'
set system login user test authentication encrypted-password '$6$Res56RWyjHBI/DgZ$7a7rPxaA4eeZVQD79ZJ5kdnaR1NcwJmHptL2AYEKm3WXiUZrp0tIL5G9GxMCvgU9NqSPZAPZf5RrXKm.aFDMc.'
set system login user test role cfg
set system security medium

Step 2: Login as test with password tEst!2qqqqqq

Step 3: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

Permission denied