Hello

Recently a router crashed and some suspicious about the client arised. The point is that now the order is to deny all kind of router admin access for the client. I was thinking, is this a good idea or will be better to give him limited access to the router, to avoid the client to try to access the router at all cost? Something like to stop the motivation to crack the router password.

Thanks.

aaa accounting and log to a server they don't have access to. They can keep their access, and you will have proof instead of suspicions next time. We log all commands, and while we haven't had to investigate an issue it has come in handy when I have to roll back a change a week after we made it, or for emergency changes, and I have to fill out the change request after the fact. Go to the log server, and get the commands that were executed.

-Otanx

In my opinion, logging first and finding out who did what will give you a better idea on what your next step should be. Based on what you find you can make decision on whether to give limited access or deny all. Personally, I always give limited access unless it's required. Clients always have the answer of "I didn't do anything!!"

_________________
Isuru Senadheera
MCSE, CCNP, CCSP, MCITP
www.isururakshitha.org

We use the archive command to log all commands. We also do not allow ssh access to the box from ANYONE expect our management range.

If anything they might get very limited snmp read only access which gives them interface statistics and not much more. We also request the IP of their snmp server and lock it down to that single IP.

_________________
www.mellowd.co.uk/ccie/

can be done with a syslog sever only or do I need TACACS, Radius, etc...?



This looks interesting, gonna investigate.

It seems that the "archive" feature doesn't support loggin exec commands, like erase flash:?

Really? tbh I probably need to take a closer look at what is and is not logged. No options at all to add exec commands as well?

_________________
www.mellowd.co.uk/ccie/

I made the test and no exec log is keep. It would be really cool it could.