Accounting

These scenarios show accounting feature when secure mode is enabled. All logs are stored in file: running://log/user/audit_file/audit_file

File Logs

Description

Show different logs stored in audit file

Scenario

Step 1: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

Secure mode started
Show output
2025-12-11 15:05:24.497287 daemon-info , modulelauncher[128637]:  Secure mode started
2025-12-11 15:05:26.134981 auth-notice , OSDxCLI:  User 'admin' has logged in.

Step 2: Run command show running at DUT0 and expect this output:

Show output
# Teldat OSDx VM version v4.2.8.1
# Thu 11 Dec 2025 15:05:26 +00:00
# Warning: Configuration has not been saved
set system login user admin authentication encrypted-password '$6$wXvfjnzOsUTtdYtd$GzsbF1NCjsLHz3xWGy0UwbSHahesoF73y8oDN2xQ1s3dlW/McuZaHq5vgobTvfmRpzboMTjfgJoxQgK5hMMod0'
set system security medium

Step 3: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

User 'admin' executed a new command: 'show running'
Show output
2025-12-11 15:05:24.497287 daemon-info , modulelauncher[128637]:  Secure mode started
2025-12-11 15:05:26.134981 auth-notice , OSDxCLI:  User 'admin' has logged in.
2025-12-11 15:05:26.274786 auth-notice , OSDxCLI:  User 'admin' executed a new command: 'file show running://log/user/audit_file/audit_file'.
2025-12-11 15:05:26.353778 auth-notice , OSDxCLI:  User 'admin' executed a new command: 'show running'.

Step 4: Set the following configuration in DUT0 :

set system cli configuration logging cli info
set system login user admin authentication encrypted-password '$6$wXvfjnzOsUTtdYtd$GzsbF1NCjsLHz3xWGy0UwbSHahesoF73y8oDN2xQ1s3dlW/McuZaHq5vgobTvfmRpzboMTjfgJoxQgK5hMMod0'
set system security medium

Step 5: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

User 'admin' committed the configuration
Show output
2025-12-11 15:05:24.497287 daemon-info , modulelauncher[128637]:  Secure mode started
2025-12-11 15:05:26.134981 auth-notice , OSDxCLI:  User 'admin' has logged in.
2025-12-11 15:05:26.274786 auth-notice , OSDxCLI:  User 'admin' executed a new command: 'file show running://log/user/audit_file/audit_file'.
2025-12-11 15:05:26.353778 auth-notice , OSDxCLI:  User 'admin' executed a new command: 'show running'.
2025-12-11 15:05:26.557027 auth-notice , OSDxCLI:  User 'admin' executed a new command: 'file show running://log/user/audit_file/audit_file'.
2025-12-11 15:05:26.716125 auth-notice , OSDxCLI:  User 'admin' entered the configuration menu.
2025-12-11 15:05:26.831088 auth-notice , OSDxCLI:  User 'admin' added a new cfg line: 'set system cli configuration logging cli info'.
2025-12-11 15:05:26.893522 auth-notice , OSDxCLI:  User 'admin' added a new cfg line: 'show working'.
2025-12-11 15:05:26.967237 user-warning , OSDxCLI:  Signal 10 received
2025-12-11 15:05:26.969579 auth-notice , OSDxCLI:  User 'admin' committed the configuration.
2025-12-11 15:05:27.054286 auth-notice , OSDxCLI:  User 'admin' left the configuration menu.

Hidden Passwords

Description

Plain passwords are not displayed

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set system aaa server tacacs TAC1 address 10.215.168.1
set system aaa server tacacs TAC1 encrypted-key U2FsdGVkX1/uU1MMtj2a4HwN5hv20I1vIjmgCbpjCGQ=
set system login user admin authentication encrypted-password '$6$38oJSKowiZYPV8nA$aP0sTouLYTEqCe6Cir.nzgcIqTiwy0q61ergdkRU1JylYIss5olOla5BILxjOuDwwjPH7/V.3sYBQTM6n0zH4/'
set system security medium

Step 2: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

User 'admin' added a new cfg line: 'set system aaa server tacacs TAC1 key ******'
Show output
2025-12-11 15:05:35.324333 daemon-info , modulelauncher[129041]:  Secure mode started
2025-12-11 15:05:36.762301 auth-notice , OSDxCLI:  User 'admin' has logged in.
2025-12-11 15:05:36.892268 auth-notice , OSDxCLI:  User 'admin' entered the configuration menu.
2025-12-11 15:05:36.996175 auth-notice , OSDxCLI:  User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
2025-12-11 15:05:37.058761 auth-notice , OSDxCLI:  User 'admin' added a new cfg line: 'set system aaa server tacacs TAC1 key ******'.
2025-12-11 15:05:37.142004 auth-notice , OSDxCLI:  User 'admin' added a new cfg line: 'set system aaa server tacacs TAC1 address 10.215.168.1'.
2025-12-11 15:05:37.217613 auth-notice , OSDxCLI:  User 'admin' added a new cfg line: 'show working'.
2025-12-11 15:05:37.462898 auth-notice , OSDxCLI:  User 'admin' committed the configuration.
2025-12-11 15:05:37.530796 auth-notice , OSDxCLI:  User 'admin' left the configuration menu.

Audit file permissions

Description

Non admin user is allowed to open audit file

Scenario

Step 1: Set the following configuration in DUT0 :

set system login role cfg level 10
set system login user admin authentication encrypted-password '$6$odHTXEyycxsikEUY$D1gkQ7M2Mh2IDR/U//HxDLOnsWIgPjQH/RUnr4BZQQRHyCz5p5NvPkxM7Mre9hoZwi2Me8538NyTlC6Z3Zvcc/'
set system login user test authentication encrypted-password '$6$LWCZDHALNll6X2W5$Gt0Kzo8ectFfPLb1coUxqswXD9US3dYkKCYlx11Wv41nPYdyG2znfz0xhiwWh/x.IBT9WZpwaSWrBvCvU4imh0'
set system login user test role cfg
set system security medium

Step 2: Login as test with password tEst!2qqqqqq

Step 3: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

Permission denied
Show output
hexdump: /opt/vyatta/etc/config/log/user/audit_file/audit_file: Permission denied
hexdump: all input file arguments failed