topic How to restrict users from viewing logging buffer in Network Security

How to restrict normal users from viewing logging buffer

dhanushkas — Fri, 06 May 2022 05:48:47 GMT

Hi All,

I would like to give normal user with all the configuring and show commands except running show logging command. i.e I want to restrict normal users by viewing syslog buffer in the switch.

I would appreciate if anyone can help me on this.

Thank you and Regards,

Gayan Samarakoon.

How to restrict users from viewing logging buffer

dhanushkas — Fri, 06 May 2022 06:08:34 GMT

Hi All,

I would like to give normal users all the configurations and show command privileges except show logging command. i.e. I want to restrict normal users from viewing logging buffer.

It would be really greatfull if some one can help me on this.

Thank you and Regards,

Dhanushka

Re: How to restrict users from viewing logging buffer

balaji.bandi — Fri, 06 May 2022 06:36:01 GMT

how is your user AAA configured , Local or any ACS/ ISE/ or Radius ?

you need to restrict the user to only with permit commands, so rest will be not authorized: its easy (if you use any identity-based system, if this is local you need to enter manually for that user - manual task)

example :

For user

permit running-config

permit cdp neigh

Re: How to restrict users from viewing logging buffer

dhanushkas — Fri, 06 May 2022 06:40:28 GMT

Hi Balaji,

Thank you for your prompt reply.

These users are created locally, I only want to restrict "show logging" command, all other commands should be permitted. Can this be done.

Thank you,

Dhanushka.

Re: How to restrict normal users from viewing logging buffer

Kasun Bandara — Fri, 06 May 2022 07:19:28 GMT

you can assign commands for privilege levels and assign relevant level to user.

https://study-ccna.com/cisco-privilege-levels/

Also you can use parser views to configure views and let relevant user to load permitted view at enable.

Re: How to restrict normal users from viewing logging buffer

dhanushkas — Fri, 06 May 2022 07:18:58 GMT

Hi Kasun,

Thank you for your reply.

I only want to restrict "show logging" command only. All Other commands should be allowed. Can this be achieved without permitting all the commands explicitly which is bit cumbersome.

Thank you,

Dhanushka.

Re: How to restrict normal users from viewing logging buffer

MHM Cisco World — Fri, 06 May 2022 11:49:57 GMT

https://www.omnisecu.com/ccna-security/parser-views-role-based-access-control-rbac.php

PARSER view can solve you issue.

Re: How to restrict normal users from viewing logging buffer

dhanushkas — Sat, 07 May 2022 17:29:56 GMT

Hi MHM,

Thanks a lot for your reply.

I will run this configuration in testing environment and get back to you if there is anything to be done.

Thank you again.

Gayan Samarakoon.