Configure Audit Log Options in FIPS Mode
Learn to configure audit log options on your device in FIPS mode.
Audit log options refer to the settings and configurations available for managing and maintaining audit logs in a system. Audit logs are records that document various activities, changes to the configuration, and events that occur within a system, providing a trail that can be used for security, compliance, and troubleshooting.
Configure Audit Log Options on Your Device in FIPS Mode
To configure audit log options on your device in FIPS mode:
Sample Code Audits for Configuration Change Audit
The following sample code audits all changes to the configured secret data and sends the logs to a file named Audit-File.
[edit system]
syslog {
file Audit-File {
authorization info;
change-log info;
interactive-commands info;
}
}
This sample code expands the minimum audit scope from the changes to the secret data to all the changes to the configuration and sends the logs to a file named Audit-File.
[edit system]
syslog {
file Audit-File {
any any;
authorization info;
change-log any;
interactive-commands info;
kernel info;
pfe info;
}
}
Example: System Logging for Configuration Changes
This example shows a sample configuration and makes changes to users and secret
data. It then shows the information sent to the audit server when the secret
data is added to the original configuration and committed with the
load command.
[edit system]
location {
country-code US;
building B1;
}
...
login {
message "UNAUTHORIZED USE OF THIS ROUTER\n\tIS STRICTLY PROHIBITED!";
user admin {
uid 2000;
class super-user;
authentication {
encrypted-password “$ABC123”;
# SECRET-DATA
}
}
}
radius-server 192.0.2.15 {
secret “$ABC123” # SECRET-DATA
}
services {
ssh;
}
syslog {
user *{
any emergency;
}
file messages {
any notice;
authorization info;
}
file interactive-commands {
interactive-commands any;
}
}
...
...
The following example shows configuration statements that change the secret data and add a new user.
security-administrator@host:fips# show | compare
[edit system login user admin authentication]
– encrypted-password “$ABC123”; # SECRET-DATA
+ encrypted-password “$ABC123”; # SECRET-DATA
[edit system login]
+ user admin2 {
+ uid 2001;
+ class operator;
+ authentication {
+ encrypted-password “$ABC123”;
# SECRET-DATA
+ }
+ }
[edit system radius-server 192.0.2.15]
– secret “$ABC123”; # SECRET-DATA
+ secret “$ABC123”; # SECRET-DATA