Accounting

These scenarios show accounting feature when secure mode is enabled. All logs are stored in file: running://log/user/audit_file/audit_file

File Logs

Description

Show different logs stored in audit file

Scenario

Step 1: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

Secure mode started
Show output
2026-06-04 10:50:10.587987 daemon-info , modulelauncher[26766]:  Secure mode started
2026-06-04 10:50:12.094238 auth-notice , OSDxCLI:  User 'admin' has logged in.

Step 2: Run command show running at DUT0 and expect this output:

Show output
# Teldat OSDx VM version v4.2.9.4
# Thu 04 Jun 2026 10:50:12 +00:00
# Warning: Configuration has not been saved
set system login user admin authentication encrypted-password '$6$F4hqVj8GgX7R0Fse$fAzpsp00ON.8lLZmTWeUtb3nYXpTblvCaDGJ8Zgca3EW2mrTAzhrrzd6q7cKTgRILUK9.paTvHUFV8xNL.vB2/'
set system security medium

Step 3: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

User 'admin' executed a new command: 'show running'
Show output
2026-06-04 10:50:10.587987 daemon-info , modulelauncher[26766]:  Secure mode started
2026-06-04 10:50:12.094238 auth-notice , OSDxCLI:  User 'admin' has logged in.
2026-06-04 10:50:12.217666 auth-notice , OSDxCLI:  User 'admin' executed a new command: 'file show running://log/user/audit_file/audit_file'.
2026-06-04 10:50:12.265353 auth-notice , OSDxCLI:  User 'admin' executed a new command: 'show running'.

Step 4: Set the following configuration in DUT0 :

set system cli configuration logging cli info
set system login user admin authentication encrypted-password '$6$F4hqVj8GgX7R0Fse$fAzpsp00ON.8lLZmTWeUtb3nYXpTblvCaDGJ8Zgca3EW2mrTAzhrrzd6q7cKTgRILUK9.paTvHUFV8xNL.vB2/'
set system security medium

Step 5: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

User 'admin' committed the configuration
Show output
2026-06-04 10:50:10.587987 daemon-info , modulelauncher[26766]:  Secure mode started
2026-06-04 10:50:12.094238 auth-notice , OSDxCLI:  User 'admin' has logged in.
2026-06-04 10:50:12.217666 auth-notice , OSDxCLI:  User 'admin' executed a new command: 'file show running://log/user/audit_file/audit_file'.
2026-06-04 10:50:12.265353 auth-notice , OSDxCLI:  User 'admin' executed a new command: 'show running'.
2026-06-04 10:50:12.445555 auth-notice , OSDxCLI:  User 'admin' executed a new command: 'file show running://log/user/audit_file/audit_file'.
2026-06-04 10:50:12.577501 auth-notice , OSDxCLI:  User 'admin' entered the configuration menu.
2026-06-04 10:50:12.681066 auth-notice , OSDxCLI:  User 'admin' added a new cfg line: 'set system cli configuration logging cli info'.
2026-06-04 10:50:12.787932 auth-notice , OSDxCLI:  User 'admin' added a new cfg line: 'show working'.
2026-06-04 10:50:12.902830 user-warning , OSDxCLI:  Signal 10 received
2026-06-04 10:50:12.904924 auth-notice , OSDxCLI:  User 'admin' committed the configuration.
2026-06-04 10:50:12.921820 auth-notice , OSDxCLI:  User 'admin' left the configuration menu.

Hidden Passwords

Description

Plain passwords are not displayed

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set system aaa server tacacs TAC1 address 10.215.168.1
set system aaa server tacacs TAC1 encrypted-key U2FsdGVkX1+12MJe7NhCNQ6vmh0/1vYsoK2LTmdKZ2k=
set system login user admin authentication encrypted-password '$6$0TLPxvyLMQygYnhG$PE6b0hxbhQFFPg4Z7l/.mSxa2JBExsunYs1wX3pSo15kwm6ZZYI.01.eYVUinpuAwRNNUIus8g9AX7E9SbgA1.'
set system security medium

Step 2: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

User 'admin' added a new cfg line: 'set system aaa server tacacs TAC1 key ******'
Show output
2026-06-04 10:50:20.213801 daemon-info , modulelauncher[27175]:  Secure mode started
2026-06-04 10:50:21.626260 auth-notice , OSDxCLI:  User 'admin' has logged in.
2026-06-04 10:50:21.764346 auth-notice , OSDxCLI:  User 'admin' entered the configuration menu.
2026-06-04 10:50:21.856851 auth-notice , OSDxCLI:  User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
2026-06-04 10:50:21.933636 auth-notice , OSDxCLI:  User 'admin' added a new cfg line: 'set system aaa server tacacs TAC1 key ******'.
2026-06-04 10:50:22.019091 auth-notice , OSDxCLI:  User 'admin' added a new cfg line: 'set system aaa server tacacs TAC1 address 10.215.168.1'.
2026-06-04 10:50:22.084809 auth-notice , OSDxCLI:  User 'admin' added a new cfg line: 'show working'.
2026-06-04 10:50:22.310617 auth-notice , OSDxCLI:  User 'admin' committed the configuration.
2026-06-04 10:50:22.335533 auth-notice , OSDxCLI:  User 'admin' left the configuration menu.

Audit file permissions

Description

Non admin user is allowed to open audit file

Scenario

Step 1: Set the following configuration in DUT0 :

set system login role cfg level 10
set system login user admin authentication encrypted-password '$6$juytkqaFL9KHuocr$B7t6KbfXCFeLI2gSR88oL.6vXAsVnq2/OO2t/wAH.0aRon.O6Q/BLlKxa1nptk3sn/TmG/uMI21rQurCU/Dch.'
set system login user test authentication encrypted-password '$6$y5Z2o5uzsEIeXvwS$2howMfo5o2lI5FqRXfYN6XTOTQE.81at2eGNsC7aSDKM.80YbhDh1BaYgWPiC821zvzZsriAfODtKP15Rn1Sa1'
set system login user test role cfg
set system security medium

Step 2: Login as test with password tEst!2qqqqqq

Step 3: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

Permission denied
Show output
hexdump: /opt/vyatta/etc/config/log/user/audit_file/audit_file: Permission denied
hexdump: all input file arguments failed