Blog Posts in November 2006
Log user privilege level changes
The logging userinfo configuration command introduced in IOS release 12.3T (integrated into 12.4) starts logging of all changes in user privilege levels (as requested by enable or disable commands).
Network Statements in the OSPF Process Are No Longer Order-Dependent
When I was still teaching Cisco courses, we were telling the students that the order of network statements in an OSPF process was important if their ranges were overlapping; the first network statement that matched an interface IP address would place that interface in the corresponding area. This is no longer true; Cisco IOS now properly handles overlapping network area configuration commands.
Consider the following example:
Deploying Zone-Based Firewalls
Cisco Press has just released my latest book (and my first digital one): Deploying Zone-Based Firewalls. The book covers a completely new way to configure IOS firewall feature set based on security zones you define on a router and inter-zone policies configured using the familiar class-maps and policy-maps.
You can preview this digital book (they call it Digital Short Cut) using the Safari technology at Cisco Press and buy it at Amazon.
Reduce the noise generated by the Cisco IOS copy command
I always hate it when Cisco IOS asks me for things I've already supplied in a command line, the most notable case being the copy command. For example, if you supply the complete source and destination file name in the command line, IOS still insists on asking you all the same questions (at least filling in the parameters I've supplied in the command line):
Log configuration commands entered on your Cisco router
As part of Configuraton Change Notification and Logging feature, Cisco IOS stores the most recent configuration commands in a circular buffer and (optionally) sends them to syslog streams.
This feature is configured under the archive configuration mode with the log config command, which brings you to yet another configuration mode where you can fine-tune the parameters (they are obvious, on-router help is sufficient), for example:
archive
log config
logging enable 100
notify syslog
hidekeys
After you've enabled configuration command logging, you can use the show archive log config all command to inspect the logging buffer. You can also display commands entered in a particular session or by a selected user.
CLI command logging without TACACS+
The Cisco IOS’s AAA architecture contains many handy features, including authorizing and logging every CLI command executed on the router. Unfortunately, the AAA command accounting only supports TACACS+ as the AAA transport protocol, making it unusable in RADIUS environments.
You can use Embedded Event Manager as a workaround. The following configuration commands will log every command executed on the router.
Cisco IOS from an attacker's perspective
Although a bit outdated (and discussing older Cisco IOS releases), the article Cisco IOS from an Attacker's Point of View is still very relevant, as most vulnerabilities discussed in it arise from unsecure router configuration. Highly recommended reading!