Black Box ET0010A, Руководство пользователя CLI

Страница: 31 / 212

User Administration
32 ETEP CLI User Guide
Audit Logging
Audit logs report attempts to gain access to the ETEP and to configure it. The audit log is configured and
viewed by the Administrator user. Audit log characteristics are as follows:
●
Audit log events are always sent to the log file.
●
Each audit record includes a date and timestamp, the user that triggered the event, and the type of
event. The audit record also includes the IP address of a remote device accessing the ETEP.
●
The most recent audit events can be viewed from the CLI using the show audit-log command. From
ETEMS, you can export the complete audit log file from the ETEP or configure the ETEP to send
audit events to a syslog server.
●
If the ETEP syslog daemon fails and is unable to record events to a designated syslog server, the
ETEP issues a platform warning trap. SNMP traps and trap hosts are configured using ETEMS.
The audit log includes all events that affect critical service parameters. The types of events that are
reported in the audit log are listed in
Table 10 .
Table 10 Audit Events
Using Common Access Cards for User
Authorization
The EncrypTight system supports the use of smart cards such as the DoD Common Access Card (CAC).
Using a CAC provides user authorization in addition to certificate-based authentication. When you use a
CAC, EncrypTight components use the certificates installed on the card to determine if a user is
authorized to perform a specific action. In order to access the system, every user must have an authorized
CAC.
A smart card reader is connected to the management workstation. To access the workstation, you must
insert a CAC into the reader. The EncrypTight software reads the identity certificate on the CAC, as well
as any trusted root or intermediate certificates. When the EncrypTight software communicates with other
EncrypTight components, the common name field from the identity certificate is included in the
Event Type Reported Events
System startup and shutdown Successful and unsuccessful startup and shutdown events.
Includes soft reboots and power cycles.
Failure State Entered failure state
Log in and Log out Successful and failed log in attempts, log out activity, account
disabled
User changes Added, modified, or disabled user profile, including user name,
role, password enforcement policy, password expiration
parameters.
Appliance Configuration Changed, saved or deleted appliance configuration.
Data Traffic Policy Changed, saved, or deployed data traffic policy
Management IPSec Policy Changed, saved, or deployed management policy
Software Version Updated software, formatted file system
Certificates Added or removed certificates.