Tracking remote logon access to my 3750 switch

[doddman11]

I need to know if someone logged into my switch without my knowledge. Is this information in default logs? 

[7367wells]

Do you have some TACACS or similar configured?

[doddman11]

I had to google this term - I do not. 

[7367wells · Accepted solution]

Ah okay, in that case I dont know of a way to do it. 

In the short term you can set up an ACL to restrict which VLANs have access via SSH to your switch. Then research setting up some kind AAA method, that way you can make sure there is a log of who is authenticating, a list of who can authenticate and what commands they have done. 

[doddman11]

follow-up questions:

1. Does AAA require a central server with specific software? And by server, does it mean a computer? 

2. These lines are at the end of the config:

line con 0
password x
login
exec-timeout 2 30
line vty 0 4
password x
login
exec-timeout 2 30
line vty 5 15
password x

login
exec-timeout 2 30

Wouldn't "line 0 15" do the same thing if the passwords are the same? 

3. What about system messages saved to the default syslog? Are these cleared once you log out of console or vty? 

[7367wells]

1. Yes you configure ACS on a server (virtual is fine). Then you can configure the switch to authenticate that ACS server. (ACS provides the AAA)

2. https://learningnetwork.cisco.com/thread/2367  should be able to shed some light on that for you. Incidentally you have exec timeout configured on only the first 5 lines.

3. I think you are referring to the normal log (show log) then it isnt cleared when you log out. 

[doddman11]

Thanks for your help and time.