Config comments logging on Cisco devices via Tacacs+

Question

I am implementing Tacacs+ in our network. It is a great tool with which help I can see where and when changes were introduced in our network. Though it's great I'd want to implement an extra feature - an ability to capture comments to made commands. I know that Cisco devices can't save comments, but is there any way to capture custom defined input from user like for example "! and log them with Tacacs+?

Answer 1

Two methods for this: one is a trick for where to put comments, the second is the syslog+git approach to looking after the configurations which one of my clients uses.

Method 1: ACL with comments

I believe there is no way to put comments directly in the Cisco configuration, so I confess I abuse an ACL:

ip access-list extended CHANGELOG
 remark 2018-01-01: did task one with champagne
 remark 2018-02-14: did task two with roses

The remarks accumulate so when you've finished a new task you just add another comment.

ip access-list extended CHANGELOG
 remark 2018-03-01: did task three

You want to log in TACACS+, (presumably an accounting message); mostly I send logging directly to syslog, but it's pretty easy to send TACACS+ packets if you want to, rather than syslog. (Tested with a tacacs_client program, as well as logger.) I'd just suggest logging system is better than an accounting system for this kind of thing, but perhaps you have your reasons. You can get all logins into syslog (login on-success log), and if you have a good TACACS+ setup, also consider full command accounting. (Thanks @cown for tips in chat.)

If you have syslog enabled on your routers you can use the syslog message to trigger a copy, or do it manually, or do it with Unix cron or similar.

When you pull the configs back to a server, you get a change line:

! Last configuration change at 09:22:29 UTC Wed Nov 28 2018 by jonathanjo

Typically I copy with scp (needs ip scp server enable) and use keys (needs ip ssh pubkey-chain), so it's scriptable and will run from cron.

It's a pretty easy matter to script something to discard unchanged configurations, and find the last line in ACL CHANGELOG (one line awk script). Then you manage them as you please: just log who did it and last line of changelog in syslog, for example (via logger), or keep them in a directory, or use git, or write in syslog (diff and logger). Some of my clients like the configs in git with passwords redacted, so we preprocess for that.

If you environment doesn't support such management scripts for whatever reason, there are a number of commercial packages which do essentially the same thing, but you can get a lot of bloat and lose a lot of simplicity.

Method 2: SSH and server-side command

How about this:

R1#ssh loghost "logger did a task" 

Ie, ssh to a server and run a command which puts something in syslog. In your case, run some command which logs to TACACS+.

Nov 28 10:20:29 R1 jonathanjo: did a task

If you write a suitable script run on login, you could just do:

R1#ssh routerbosshost

The login script could ask you what you did, and log it.

Alternatively, for a much higher level of management: See where the login is coming from, scp the running config from that router, run appropriate git commit which then asks you what you did and saves it.

The meat of the task (without error checking etc) is just a few lines of Bourne shell script which the client runs on a "router boss" Unix host dedicated to this. They have a routerbak user with a SSH key so they can get automated backups etc from routers. This, combined with logging every login, actually proved to be the magic to get the admins to actually do it every time.

host=${SSH_CONNECTION%% *}  # gets IP address of ssh client
scp -i ~/.ssh/key routerbak@$host:running-config TMP
hostname=$( awk '($1 == "hostname") {print $2; exit;}' TMP )
mv TMP $hostname.config 
git add $hostname.config
git commit || exit  # 'nothing to commit' exits here
gitmsg=$( git log -1 --oneline )
logger -t routerbak "$USER updated $hostname.config ($gitmsg)"

Which gives syslogs like the following (slightly edited to be easier to read):

Nov 29 11:32:03 192.168.0.1 
  1423: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success
  [user: jonathanjo] [Source: 192.168.0.210] ...
Nov 29 11:32:10 192.168.0.1 1424: 
  %SYS-5-CONFIG_I: Configured from console by jonathanjo on vty1 (192.168.0.210)
Nov 29 11:32:56 192.168.0.1 1425:
  %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success
  [user: routerbak] [Source: 192.168.0.32] ...
Nov 29 11:33:11 routerboss routerbak: 
  jonathanjo updated gwdev.config (9b074fd Fixed ACL for new dev room)

Which show I logged in from laptop .210 to gwdev .1, changed the config, logged in to router boss .32 and did the backup and git. Obviously with everything in git you know exactly what was done, as well as the message and git log.

2018-11-29 11:32:58 jonathanjo 9b074fd Fixed ACL for new dev room
2018-11-29 11:01:51 jonathanjo fbbd535 Finally fixed PPP fragmentation
2018-11-29 11:00:34 jonathanjo f0daa25 Fixed ACL which broken on ISP change