Configuração de servidor Syslog de amostra em um sistema Linux
Um ambiente seguro do Junos OS requer auditoria de eventos e armazenamento em um arquivo de auditoria local. Os eventos registrados são enviados simultaneamente a um servidor externo de syslog. Um servidor de syslog recebe as mensagens de syslog transmitidas do dispositivo. O servidor de syslog deve ter um cliente SSH com suporte NETCONF configurado para receber as mensagens de syslog transmitidas.
Os logs NDcPP capturam os eventos, poucos deles estão listados abaixo:
Mudanças comprometidas
Login e logotipo de usuários
Falha em estabelecer uma sessão de SSH
Estabelecimento ou encerramento de uma sessão de SSH
Mudanças no tempo do sistema
Configuração do registro de eventos em um arquivo local
Você pode configurar o armazenamento de mensagens em um arquivo local e o nível de detalhe a ser registrado com a syslog declaração. Este exemplo armazena logs em um arquivo chamado syslog:
[edit system]
syslog {
file syslog;
}
Configuração do registro de eventos em um servidor remoto
Configure a exportação de informações de auditoria para um servidor seguro e remoto configurando um monitor de rastreamento de eventos que envia mensagens de log de eventos usando o NETCONF sobre SSH para o servidor de registro de eventos do sistema remoto. Os procedimentos a seguir mostram a configuração necessária para enviar mensagens de log do sistema para um servidor externo seguro usando o NETCONF sobre SSH.
Configuração do registro de eventos em um servidor remoto ao iniciar a conexão a partir do servidor remoto
O procedimento a seguir descreve as etapas para configurar o registro de eventos em um servidor remoto quando a conexão SSH com o TOE é iniciada a partir do servidor de log do sistema remoto.
A saída a seguir mostra os resultados do log de teste para o servidor de syslog.
host@ssh-keygen -b 2048 -t rsa -C 'syslog-monitor key pair' -f ~/.ssh/syslog-monitor Generating public/private rsa key pair. Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/host/.ssh/syslog-monitor. Your public key has been saved in /home/host/.ssh/syslog-monitor.pub. The key fingerprint is: ef:75:d7:68:c5:ad:8d:6f:5e:7a:7e:9b:3d:f1:4d:3f syslog-monitor key pair The key's randomart image is: +--[ RSA 2048]----+ | | | | | | | ..| | S +| | . Bo| | . . *.X| | . . o E@| | . .BX| +-----------------+ [host@linux]$ cat /home/host/.ssh/syslog-monitor.pub ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCrUREJUBpjwAoIgRrGy9zgt+ D2pikk3Q/Wdf8I5vr+njeqJhCx2bUAkrRbYXNILQQAZbg7kLfi/8TqqL eon4HOP2e6oCSorKdx/GrOTzLONL4fh0EyuSAk8bs5JuwWNBUokV025 gzpGFsBusGnlj6wqqJ/sjFsMmfxyCkbY+pUWb8m1/A9YjOFT+6esw+9S tF6Gbg+VpbYYk/Oday4z+z7tQHRFSrxj2G92aoliVDBLJparEMBc8w LdSUDxmgBTM2oadOmm+kreBUQjrmr6775RJn9H9YwIxKOxGm4SFnX/Vl4 R+lZ9RqmKH2wodIEM34K0wXEHzAzNZ01oLmaAVqT syslog-monitor key pair [host@linux]$ eval `ssh-agent ` Agent pid 1453 [host@linux]$ ssh-add ~/.ssh/syslog-monitor Enter passphrase for /home/host/.ssh/syslog-monitor: Identity added: /home/host/.ssh/syslog-monitor (/home/host/.ssh/syslog-monitor)
Canal de configuração líquida
host@linux]$ ssh syslog-mon@starfire -s netconf>test.out
host@linux]$ cat test.out
this is NDcPP test device
<!-- No zombies were killed during the creation of this user interface --
<!-- user syslog-mon, class j-monitor -><hello>
<capabilities>
<capability>urn:ietf:params:xml:ns:netconf:base:1.0</capability>
<capability>urn:ietf:params:xml:ns:netconf:capability:candidate:1.0</capability>
<capability>urn:ietf:params:xml:ns:netconf:capability:confirmed-commit:1.0</capability>
<capability>urn:ietf:params:xml:ns:netconf:capability:validate:1.0</capability>
<capability>urn:ietf:params:xml:ns:netconf:capability:url:1.0?protocol=http,ftp,file</capability>
<capability>http://xml.juniper.net/netconf/junos/1.0</capability>
<capability>http://xml.juniper.net/dmi/system/1.0</capability>
</capabilities>
<session-id4129/session-id>
</hello>
]]>]]>
A saída a seguir mostra logs de eventos gerados no TOE que são recebidos no servidor do syslog.
Jan 20 17:04:51 starfire sshd[4182]: error: Could not load host key: /etc/ssh/ssh_host_dsa_key Jan 20 17:04:51 starfire sshd[4182]: error: Could not load host key: /etc/ssh/ssh_host_ecdsa_key Jan 20 17:04:53 starfire sshd[4182]: Accepted password for sec-admin from 10.209.11.24 port 55571 ssh2 Jan 20 17:04:53 starfire mgd[4186]: UI_AUTH_EVENT: Authenticated user 'sec-admin' at permission level 'j-administrator' Jan 20 17:04:53 starfire mgd[4186]: UI_LOGIN_EVENT: User 'sec-admin' login, class 'j-administrator' [4186], ssh-connection '10.209.11.24 55571 10.209.14.92 22', client-mode 'cli'
Canal de configuração líquida
host@linux]$ ssh syslog-mon@starfire -s netconf
this is NDcPP test device
<!-- No zombies were killed during the creation of this user interface --
<!-- user syslog-mon, class j-monitor -><hello>
<capabilities>
<capability>urn:ietf:params:xml:ns:netconf:base:1.0</capability>
<capability>urn:ietf:params:xml:ns:netconf:capability:candidate:1.0</capability>
<capability>urn:ietf:params:xml:ns:netconf:capability:confirmed-commit:1.0</capability>
<capability>urn:ietf:params:xml:ns:netconf:capability:validate:1.0</capability>
<capability>urn:ietf:params:xml:ns:netconf:capability:url:1.0?protocol=http,ftp,file</capability>
<capability>http://xml.juniper.net/netconf/junos/1.0</capability>
<capability>http://xml.juniper.net/dmi/system/1.0</capability>
</capabilities>
<session-id4129/session-id>
</hello>
]]>]]>
A saída a seguir mostra que os syslogs locais e os syslogs remotos recebidos são semelhantes.
Local : an 20 17:09:30 starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: Redundancy interface management process checking new configuration Jan 20 17:09:30 starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/rdd' Jan 20 17:09:30 starfire mgd[4186]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/rdd', PID 4317, status 0 Jan 20 17:09:30 starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: Dynamic flow capture service checking new configuration Jan 20 17:09:30 starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/dfcd' Jan 20 17:09:30 starfire mgd[4186]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/dfcd', PID 4318, status 0 Jan 20 17:09:30 starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: Connectivity fault management process checking new configuration Jan 20 17:09:30 starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/cfmd' Jan 20 17:09:30 starfire mgd[4186]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/cfmd', PID 4319, status 0 Jan 20 17:09:30 starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: Layer 2 address flooding and learning process checking new configuration Jan 20 17:09:30 starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/l2ald' Jan 20 17:09:30 starfire mgd[4186]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/l2ald', PID 4320, status 0 Jan 20 17:09:30 starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: Layer 2 Control Protocol process checking new configuration Jan 20 17:09:30 starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/l2cpd' Jan 20 17:09:30 starfire l2cp[4321]: Initializing PNAC state machines Jan 20 17:09:30 starfire l2cp[4321]: Initializing PNAC state machines complete Jan 20 17:09:30 starfire l2cp[4321]: Initialized 802.1X module and state machinesJan 20 17:09:30 starfire l2cp[4321]: Read acess profile () config Jan 20 17:09:30 starfire mgd[4186]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/l2cpd', PID 4321, status 0 Jan 20 17:09:30 starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: Multicast Snooping process checking new configuration Jan 20 17:09:30 starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/mcsnoopd' Jan 20 17:09:30 starfire mgd[4186]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/mcsnoopd', PID 4325, status 0 Jan 20 17:09:30 starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: commit wrapup... Jan 20 17:09:30 starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: activating '/var/etc/ntp.conf' Jan 20 17:09:30 starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: start ffp activate Jan 20 17:09:30 starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/ffp' Jan 20 17:09:30 starfire ffp[4326]: "dynamic-profiles": No change to profiles....................................
Remote : an 20 17:09:30 starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: Redundancy interface management process checking new configuration Jan 20 17:09:30 starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/rdd' Jan 20 17:09:30 starfire mgd[4186]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/rdd', PID 4317, status 0 Jan 20 17:09:30 starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: Dynamic flow capture service checking new configuration Jan 20 17:09:30 starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/dfcd' Jan 20 17:09:30 starfire mgd[4186]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/dfcd', PID 4318, status 0 Jan 20 17:09:30 starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: Connectivity fault management process checking new configuration Jan 20 17:09:30 starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/cfmd' Jan 20 17:09:30 starfire mgd[4186]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/cfmd', PID 4319, status 0 Jan 20 17:09:30 starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: Layer 2 address flooding and learning process checking new configuration Jan 20 17:09:30 starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/l2ald' Jan 20 17:09:30 starfire mgd[4186]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/l2ald', PID 4320, status 0 Jan 20 17:09:30 starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: Layer 2 Control Protocol process checking new configuration Jan 20 17:09:30 starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/l2cpd' Jan 20 17:09:30 starfire l2cp[4321]: Initializing PNAC state machines Jan 20 17:09:30 starfire l2cp[4321]: Initializing PNAC state machines complete Jan 20 17:09:30 starfire l2cp[4321]: Initialized 802.1X module and state machinesJan 20 17:09:30 starfire l2cp[4321]: Read acess profile () config Jan 20 17:09:30 starfire mgd[4186]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/l2cpd', PID 4321, status 0 Jan 20 17:09:30 starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: Multicast Snooping process checking new configuration Jan 20 17:09:30 starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/mcsnoopd' Jan 20 17:09:30 starfire mgd[4186]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/mcsnoopd', PID 4325, status 0 Jan 20 17:09:30 starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: commit wrapup... Jan 20 17:09:30 starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: activating '/var/etc/ntp.conf' Jan 20 17:09:30 starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: start ffp activate Jan 20 17:09:30 starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/ffp' Jan 20 17:09:30 starfire ffp[4326]: "dynamic-profiles": No change to profiles ...............