Manualshelf

Users Guide

ManualsBrandsDell ManualsAccess PlatformsSmartFabric OS10 Documentation
1351135213531354135513561357135813591360
Table Of Contents
User admin on console used cmd: 'crypto security-profile mltestprofile' - success
<110>1 2019-02-14T13:15:21.794529+00:00 OS10 .clish 7412 - - Node.1-Unit.1:PRI [audit],
User admin on console used cmd: 'exit' - success
<110>1 2019-02-14T13:16:05.882555+00:00 OS10 .clish 7412 - - Node.1-Unit.1:PRI [audit],
User admin on console used cmd: 'exit' - success
OS10# show logging audit reverse 4
<110>1 2019-02-14T13:16:05.882555+00:00 OS10 .clish 7412 - - Node.1-Unit.1:PRI [audit],
User admin on console used cmd: 'exit' - success
<110>1 2019-02-14T13:15:21.794529+00:00 OS10 .clish 7412 - - Node.1-Unit.1:PRI [audit],
User admin on console used cmd: 'exit' - success
<110>1 2019-02-14T13:15:16.331515+00:00 OS10 .clish 7412 - - Node.1-Unit.1:PRI [audit],
User admin on console used cmd: 'crypto security-profile mltestprofile' - success
<14>1 2019-02-14T13:15:06.283337+00:00 OS10 audispd - - - Node.1-Unit.1:PRI [audit],
Dell EMC (OS10) node=OS10 type=USER_END msg=audit(1550150106.277:597): pid=7908 uid=0
auid=4294967295 ses=4294967295 msg='op=PAM:session_close acct="admin" exe="/bin/su"
hostname=? addr=? terminal=??? res=success'OS10# show logging audit reverse 10
Supported Releases
10.4.3.0 or later
logging audit enable
Enables recording of configuration and security event in the audit log.
Syntax
logging audit enable
Parameters None
Defaults Not configured
Command Mode CONFIGURATION
Usage
Information
Audit log entries are saved locally and sent to configured Syslog servers. Only the sysadmin and
secadmin roles can enable the audit log. The no version of the command disables audit log recording.
Example
OS10(conf)# logging audit enable
Supported
Releases
10.4.3.0 or later
X.509v3 certificates
OS10 supports X.509v3 certificates to secure communications between the switch and a host, such as a RADIUS server. Both
the switch and the server exchange a public key in a signed X.509v3 certificate issued by a certificate authority (CA) to
authenticate each other. The certificate authority uses its private key to sign the switch and host certificates.
The information in the certificate allows both devices to prove ownership and the validity of a public key. Assuming the CA
is trusted, the switch and authentication server validate each other's identity and set up a secure, encrypted communications
channel.
User authentication with a public key certificate is usually preferred over password-based authentication, although you can use
both at the same time, to:
● Avoid the security risk of using low-strength passwords and provide greater resistance to brute-force attacks.
● Provide assurance of trusted, provable identities (when using certificates digitally signed by a trusted CA).
● Provide security and confidentiality in switch-server communications in addition to user authentication.
For example, you can download and install a X.509v3 certificate to enable public-key authentication in RADIUS over TLS
authentication — also called RadSec. OS10 supports a public key infrastructure (PKI), including:
● Generation of self-signed certificates and certificate signing requests (CSRs), and their corresponding private keys
● Installation and deletion of self-signed certificates and CA-signed certificates
● Secure deletion of corresponding private keys
● Installation and deletion of CA certificates in the system "trust store"
● Display of certificate information
Security
1351