Cisco: monitoring users input

Question

Is there a way to monitor a user's input on a cisco device?

Clarification: the commands a user have entered as in configuration mode AND normal mode. (especialy normal mode. Configuration mode can be done with "show history").

Answer 1

Have a look at this IOSHints post: CLI command logging without TACACS+. And the title seems to imply it can also be done with TACACS+.

Answer 2

Assuming you are using TACACS+ you can configure:

tacacs-server host x.x.x.x key xxxxx

aaa accounting commands 0 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+

Also include a line for any other enable levels that you may use.

Answer 3

Since your question is not restricted to IOS: on Cisco ASA devices you can see executed commands in the syslog. They look this way:

May 17 11:45:12 192.168.0.1 %ASA-5-514008: User 'stefan' executed the 'write memory' command.

So you could filter for such messages, for example using grep and a cron job. Of course you need to have the required severity level set, here 5 for notification.

I used splunk for directly receiving and storing firewall syslog messages, programmed a daily running alert which sends me all ASA syslog lines containing "executed" as a summary email. I did this because I already had splunk in place for monitoring and reporting.

Answer 4

TACACS+ is the preferred method to log CLI commands at any enable level. See the AAA and TACACS commands for configuration. There's open source software if you don't have or can't afford Cisco ACS or similar products.

But for a really cool and rarely used feature, you could have the switch itself run a config diff(erence) on the running-config and startup-config and email the changes or deltas to you!

Here's how I have 4510R switches configured to email config changes. This uses the event manager to do the work.

First, some common settings for the mail server, from, and to addresses.

    event manager environment _email_server a.b.c.d.
    event manager environment _email_from [email protected]
    event manager environment _email_to [email protected]

Then, the actual applet to do the diff. This is fairly self-explanatory.

    event manager applet config_diff_email authorization bypass
    event syslog pattern ".*%SYS-5-CONFIG.*"
    action 1.0 info type routername
    action 1.1 cli command "enable"
    action 1.2 cli command "show archive config diff nvram:/startup-config system:/running-config"
    action 1.3 mail server "$_email_server" to "$_email_to" from "$_email_from" subject "Config Change Alert ($_info_routername)" body "$_cli_result"
    action 1.4 syslog msg "Config Change Alert emailed" 

Note that even going into config and not making changes still triggers the diff email. And one downside with this is CPU spike that happens for about 10 seconds while it runs.

Answer 5

I use the following configuration and it logs config commands, as well as a few others like 'enable':

archive
 log config
  logging enable
  notify syslog
  hidekeys