topic Re: Telnet access and syslog messages in Network Security

Telnet access and syslog messages

carrara_ictc — Sun, 10 Mar 2019 10:56:50 GMT

Hi,

in this forum I found that to log telnet access to routers (Successful/Unsuccessful - Authorized/Unauthorized) a possible configuration is:

access-list 10 permit 10.1.1.1

access-list 10 permit 10.51.21.34

access-list 10 permit 10.51.8.32

I find on cisco.com these syslog events related to telnet:

%TN-2-BADLOGIN : Bad login string pointer [hex]

%TN-3-BADSTATE : Illegal state [dec]

%TN-3-READLINE : Unknown return code [dec] from telnet_readline()

(http://www.cisco.com/en/US/docs/ios/12_3/sem2/system/messages/emgtdm.html#wp139576)

"%TN-2-BADLOGIN : Bad login string pointer [hex]" is related to unauthorized telnet access to the router?

Can you suggest me some syslog messages generated when someone tries to access a router?

Thanks a lot

Re: Telnet access and syslog messages

ivillegas — Thu, 24 Jan 2008 19:14:58 GMT

I have experienced "% telnet connections not permitted from this terminal " messages on the console. Issuing the command "transport output telnet ssh " under line vty 04 resolves this issues.

Re: Telnet access and syslog messages

cisco24x7 — Thu, 24 Jan 2008 20:01:10 GMT

Try this:

Here is a message of someone login unsuccessfully to a router:

Jan 24 17:59:16 10.109.114.101 13632: Jan 24 19:59:15: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: dkdkdk] [Source: 192.168.1.1] [localport: 23] [Reason: Login Authentication Failed - BadUser] at 19:59:15 UTC Thu Jan 24 2008

Easy right?

CCIE Security

Re: Telnet access and syslog messages

fisko — Wed, 21 Apr 2010 07:08:49 GMT

What about OLD IOS this is extended login feature in 12.4(3)?