配置更改的示例代码审核
此示例代码审核对配置机密数据的所有更改，并将日志发送到名为 syslog 的文件：
[edit system]
syslog {
file syslog {
authorization info;
change-log info;
interactive-commands info;
}
}
此示例代码扩展了最小审核的范围，以审核对配置的所有更改，而不仅仅是机密数据，并将日志发送到名为 syslog 的文件：
[edit system]
syslog {
file syslog {
any any;
authorization info;
change-log any;
interactive-commands info;
kernel info;
pfe info;
}
}
示例：配置更改的系统日志记录
此示例显示了一个示例配置，并对用户和机密数据进行了更改。然后，它会显示将机密数据添加到原始配置并使用命令提交 load 时发送到审核服务器的信息。
[edit system]
location {
country-code US;
building B1;
}
...
login {
message "UNAUTHORIZED USE OF THIS ROUTER\n\tIS STRICTLY PROHIBITED!";
user admin {
uid 2000;
class super-user;
authentication {
encrypted-password “$ABC123”;
# SECRET-DATA
}
}
password {
format md5;
}
}
radius-server 192.0.2.15 {
secret “$ABC123” # SECRET-DATA
}
services {
ssh;
}
syslog {
user *{
any emergency;
}
file syslog {
any notice;
authorization info;
}
file interactive-commands {
interactive-commands any;
}
}
...
...
新配置将更改机密数据配置语句并添加新用户。
user@host# show | compare
[edit system login user admin authentication]
– encrypted-password “$ABC123”; # SECRET-DATA
+ encrypted-password “$ABC123”; # SECRET-DATA
[edit system login]
+ user admin2 {
+ uid 2001;
+ class operator;
+ authentication {
+ encrypted-password “$ABC123”;
# SECRET-DATA
+ }
+ }
[edit system radius-server 192.0.2.15]
– secret “$ABC123”; # SECRET-DATA
+ secret “$ABC123”; # SECRET-DATA