Assume a scenario where a network technician in an organization may remotely access network devices for routine maintenance, but should only be able to set up network configurations (e.g. VLAN settings, filtering rules) that are authorized by a central entity of the organization.

Is it usually supported by common switches to verify (non-OEM) signatures of configuration files in order to prevent unauthorized changes?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it. – Ron Maupin Aug 7 '17 at 14:02

AAA configs on a network device can tell it to pass all authorisation checks back to an ACS / ISE / RADIUS server. The backend server can then send a message back to the device saying "Yes that person can do that command" or "No, they're unauthorised".

Additionally, on some Cisco devices at least, you can mark the boot image and config file as being secured - you can make it impossible to edit or remove them except with physical access to the console port.

Not sure about actually signing copies of the config though. You'd need to check the signature against a CA which you couldn't do unless the device was online and able to contact the CA. You could save certificates locally, but so could an attacker to work around this.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.