topic Auditing the admin guy in Network Security

Auditing the admin guy

Andy White — Tue, 12 Mar 2019 01:41:11 GMT

Hello,

I log everything from my ASAs to a syslog server, so when I make any changes there is an audit trail of what I have been doing, however my boss said what is stopping you turning off the logging and doing something malicious and then turning the logging back on?

Firstly if I turn off or on logging can it send a syslog message?

Secondly is there any software out there that can help?

Thanks

Auditing the admin guy

Julio Carvajal — Thu, 09 May 2013 16:53:00 GMT

Hello Andy,

Why dont you use AAA accounting and you can audit all of the commands you enter while being logged into the ASA, you can then export them to a syslog server to analize them,

That would be a great way to do it, don't you think?

Regards,

Julio Carvajal

Auditing the admin guy

Andy White — Thu, 09 May 2013 17:58:31 GMT

Hi,

What is the difference to what I am doing and what is stopping me from turning accounting off and making a malicious change then turning it back on so I dont get noticed?

Re: Auditing the admin guy

malshbou — Thu, 09 May 2013 18:57:27 GMT

Hi,

for me, it looks like what would stop an admin from turning off logging/accounting is leveraging those two commands to some higher privilege level (command authorization) which only the boss can have. say level 14 can execute all commands except disabling logging (or aaa accounting), and disabling aaa command authorization, which will be available only for level 15.

An admin should have level 14, and a boss should have level 15.

If the question now turns into: "what is stopping a boss turning off the logging and doing something malicious ?", then i believe it would be an issue of trust and ethics.

Hope this helps

------------------
Mashal Alshboul

Re: Auditing the admin guy

Julio Carvajal — Thu, 09 May 2013 19:09:05 GMT

Hello Andy,

When I set aaa accounting it mean that you were going to run authentication and then you could use the AAA framework for the extra-work.

Setting a shell profile policy stating that you are allow to set any command except the ones that stop the logging stuff and the aaa accounting stop,

I mean you have it all within the AAA framework........

Regards,

Re: Auditing the admin guy

Jatin Katyal — Sat, 11 May 2013 21:03:02 GMT

I agree with Mashal, this can be achieved using command authorization. You may use LOCAL or tacacs+.