Security event log

Security user logs are accessible when both the authentication and authorization are local. A default group called the default-security-group is available in manager mode and has the privileges to execute the commands copy security-log, show security-logging and clear security-logging. When a security user is attached to the group, they will only be able to execute the three commands. Any other user will not be able to execute the commands, no matter whether they are an operator or manager.

​Syntax

​Syntax

​Syntax

​Syntax

For RADIUS authentication and authorization, the security user will be able to access to security log by configuring the file located on RADIUS server.

/etc/raddb/users
steve Cleartext-Password := "testing"
Service-Type = Administrative-User,
HP-Command-Exception=0,
HP-Command-String="copy security log;show security-logging;clear security-logging”

For TACACS+ authentication and authorization, the user can access to security log by configuring the file located on TACACS+ server.

/etc/tacacs/tac_plus.cfg
group = admin {
# default service = permit
service = exec {
priv-lvl = 15
}
cmd = copy security-log {

permit .*
}
cmd = copy show security-logging {
permit .*
}
cmd = clear security-logging {
permit .*

In the case of local authentication and authorization, the default-security-group group only applies to manager logins for CLI actions; menu interface and Web UI capabilities.

To add a new log message when the event buffer wraps, a new RMON log is generated when the buffer wrapping is identified.

The following commands configure the max concurrent sessions allowable.

Configures the max concurrent sessions allowable per user. The [no] command restores the default value.

Configures the max concurrent sessions allowable per user in the switches. The [no] command restores the default value.

​Syntax

Authentication happens by sending authentication request to the Authentication sub system. The Authentication sub system then authenticates and sends back the authentication result. If an authentication failure is identified, a delay is introduced so that the next authentication request is not serviced immediately. This is applicable for console, telnet and ssh sessions.