Unauthorized telnet access

[faizanelahi]

Hello,

Could anyone guide in writing eem script to allow users to access telnet session based on IP Address..

Or, to send email whenever some one telnets the device.

Regards,

Faizan.

[Joe Clarke · Accepted solution]

If you want to limit telnet access by IP, use an access-list and access-class on the VTY lines.  EEM cannot help you there.

You can have EEM react to logon messages provided you have "login on-success log" configured.  That would be:

event manager applet telnet-login

 event syslog pattern "Login Success.*local port: 23"

 action 1.0 mail from user@company.com to user@company.com subject "Telnet Login" server 10.1.1.1 body "User just telneted to device"

[faizanelahi]

Thank you Joe..

That worked...

[faizanelahi]

Hi Joe,

I have another requirement, dont know will it possible or not.

As of now, whoever logins in to a device we are getting emails, up to that it is fine.

Now, i want to filter those login attempts...whenever management logins we dont want to get an email..when other persons logins it should notify us.

Is it possible ??

Regards,

Faizan. 

[Joe Clarke]

Assuming it's the username, "management" you can do:

action 1.0 regexp "user: management" $_syslog_msg

action 1.1 if $_regexp_result eq 0

action 1.2  mail ...

action 1.3 end

[faizanelahi]

Thanks for your valuable suggestion joe.

Can we write something like this in one script....

Other than one user management, whoever logins send mail (Since to specify each and every name will be tough) 

is it possible with expressions ??

Regards,

Faizan.

[Joe Clarke]

I don't understand what you're asking here.  The snippet above will send email for every user other than "management" that logs in via telnet.

[faizanelahi]

Got it. Thanks a lot