Hi everyone.
I would like to read opinions regarding if you think it's worth it or not to activate/enable AAA Accounting Connection on a switch or router in which the only outbound connections are SSH, SNMP Traps and SMTP. What I usually see in Cisco's documentation is that it registers telnet and rlogin connections, but I don't know if it works with other protocols.
Here's what the CIS Benchmark says regarding this configuration:
1.1.8 Set 'aaa accounting connection' (Scored)
Profile Applicability:
Level 2
Description:
Provides information about all outbound connections made from the network access server.
Rationale:
Authentication, authorization and accounting (AAA) systems provide an authoritative source for managing and monitoring access for devices. Centralizing control improves consistency of access control, the services that may be accessed once authenticated and accountability by tracking services accessed. Additionally, centralizing access control simplifies and reduces administrative costs of account provisioning and de-provisioning, especially when managing a large number of devices. AAA Accounting provides a management and audit trail for user and administrative sessions through RADIUS and TACACS+.
