Accounting

These scenarios show accounting feature when secure mode is enabled. All logs are stored in file: running://log/user/audit_file/audit_file

File Logs

Description

Show different logs stored in audit file

Scenario

Step 1: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

Secure mode started
Show output
2026-03-23 08:18:49.418390 daemon-info , modulelauncher[167855]:  Secure mode started
2026-03-23 08:18:50.786947 auth-notice , OSDxCLI:  User 'admin' has logged in.

Step 2: Run command show running at DUT0 and expect this output:

Show output
# Teldat OSDx VM version v4.2.9.1
# Mon 23 Mar 2026 08:18:50 +00:00
# Warning: Configuration has not been saved
set system login user admin authentication encrypted-password '$6$JIYK3i8TJ6XHPo1W$LXo26wm3DJ2mGl.w7FVrRhJLMaa5iszwUMKQ4.tW4D.YBH5iPplcbXVOli77O.nR.ZBH470ZKagaKSfwjvyHu/'
set system security medium

Step 3: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

User 'admin' executed a new command: 'show running'
Show output
2026-03-23 08:18:49.418390 daemon-info , modulelauncher[167855]:  Secure mode started
2026-03-23 08:18:50.786947 auth-notice , OSDxCLI:  User 'admin' has logged in.
2026-03-23 08:18:50.893017 auth-notice , OSDxCLI:  User 'admin' executed a new command: 'file show running://log/user/audit_file/audit_file'.
2026-03-23 08:18:50.934576 auth-notice , OSDxCLI:  User 'admin' executed a new command: 'show running'.

Step 4: Set the following configuration in DUT0 :

set system cli configuration logging cli info
set system login user admin authentication encrypted-password '$6$JIYK3i8TJ6XHPo1W$LXo26wm3DJ2mGl.w7FVrRhJLMaa5iszwUMKQ4.tW4D.YBH5iPplcbXVOli77O.nR.ZBH470ZKagaKSfwjvyHu/'
set system security medium

Step 5: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

User 'admin' committed the configuration
Show output
2026-03-23 08:18:49.418390 daemon-info , modulelauncher[167855]:  Secure mode started
2026-03-23 08:18:50.786947 auth-notice , OSDxCLI:  User 'admin' has logged in.
2026-03-23 08:18:50.893017 auth-notice , OSDxCLI:  User 'admin' executed a new command: 'file show running://log/user/audit_file/audit_file'.
2026-03-23 08:18:50.934576 auth-notice , OSDxCLI:  User 'admin' executed a new command: 'show running'.
2026-03-23 08:18:51.102954 auth-notice , OSDxCLI:  User 'admin' executed a new command: 'file show running://log/user/audit_file/audit_file'.
2026-03-23 08:18:51.213465 auth-notice , OSDxCLI:  User 'admin' entered the configuration menu.
2026-03-23 08:18:51.269094 auth-notice , OSDxCLI:  User 'admin' added a new cfg line: 'set system cli configuration logging cli info'.
2026-03-23 08:18:51.358479 auth-notice , OSDxCLI:  User 'admin' added a new cfg line: 'show working'.
2026-03-23 08:18:51.420740 user-warning , OSDxCLI:  Signal 10 received
2026-03-23 08:18:51.423173 auth-notice , OSDxCLI:  User 'admin' committed the configuration.
2026-03-23 08:18:51.478093 auth-notice , OSDxCLI:  User 'admin' left the configuration menu.

Hidden Passwords

Description

Plain passwords are not displayed

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set system aaa server tacacs TAC1 address 10.215.168.1
set system aaa server tacacs TAC1 encrypted-key U2FsdGVkX18ICjL4xr5YAvSyadAAqYCrMHTbelaUHMg=
set system login user admin authentication encrypted-password '$6$z21U188rd6XGjIAX$oh2/LK40ndFt9N097aecLGvy3AJxAOp4wYj.yMPVccv0LuiHKKaZ1sL1KCfJlTMd/t2ClMjTrIWujB5FIv/Yz1'
set system security medium

Step 2: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

User 'admin' added a new cfg line: 'set system aaa server tacacs TAC1 key ******'
Show output
2026-03-23 08:18:59.125225 daemon-info , modulelauncher[168264]:  Secure mode started
2026-03-23 08:19:00.719606 auth-notice , OSDxCLI:  User 'admin' has logged in.
2026-03-23 08:19:00.875351 auth-notice , OSDxCLI:  User 'admin' entered the configuration menu.
2026-03-23 08:19:00.969248 auth-notice , OSDxCLI:  User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
2026-03-23 08:19:01.060052 auth-notice , OSDxCLI:  User 'admin' added a new cfg line: 'set system aaa server tacacs TAC1 key ******'.
2026-03-23 08:19:01.156776 auth-notice , OSDxCLI:  User 'admin' added a new cfg line: 'set system aaa server tacacs TAC1 address 10.215.168.1'.
2026-03-23 08:19:01.232390 auth-notice , OSDxCLI:  User 'admin' added a new cfg line: 'show working'.
2026-03-23 08:19:01.451042 auth-notice , OSDxCLI:  User 'admin' committed the configuration.
2026-03-23 08:19:01.468030 auth-notice , OSDxCLI:  User 'admin' left the configuration menu.

Audit file permissions

Description

Non admin user is allowed to open audit file

Scenario

Step 1: Set the following configuration in DUT0 :

set system login role cfg level 10
set system login user admin authentication encrypted-password '$6$mnpwpGYQh24.PeKT$UgSUqTPzcVZEni3YGD2eMlbPWhPb0Cu9EtM4RjmU7Ip5dbWWB0A1qS9NvUR7sUvyh6IJ3bQQSABuND5Fzorvj1'
set system login user test authentication encrypted-password '$6$D5qpbMX5TPtNp4N0$yMe.4cOLWz/x09zsm15S3KnumtPMIbjNPdqiEbCsFufMrlH7KyC9StXdOat5am2jTT/dYQM7q2v6EUFTQVkMv.'
set system login user test role cfg
set system security medium

Step 2: Login as test with password tEst!2qqqqqq

Step 3: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

Permission denied
Show output
hexdump: /opt/vyatta/etc/config/log/user/audit_file/audit_file: Permission denied
hexdump: all input file arguments failed