Is there a way to setup an alert if SSH / telnet services change?

Question

Thwack Forum,

I am working at a client site where they have some NERC compliancy standards to adhere to.  An administrator reached out to me this morning to ask

if I could monitor a change in SSH / telnet services?

I was thinking that I could build a customer poller to get the status of SSH and telnet on a switch.  Can I build an alarm from there?

Thank You!

RichardLetts · Answer

NCM should download the configs from the devices (at least nightly, ideally every time they are changed)

one can define policy reports about what should appear in the configuration (e.g. the lines to sync with time servers, send syslogs to your audit servers, etc..)

Nightly these reports can your configuration files and let you know if your configuration file has been munged (and they can optionally apply config changes to revert/ensure conformance).

Sounds like the right tool for this task...

/RjL

KMNRuser · Answer

Muckman,

I appreciate your response.  Can you be more specific?

NCM is installed here, but another team takes care of that.

Any input you have would be welcome.

Thanks,

KMNRuser

muckman · Answer

NCM would be the ideal product to detect config changes on a switch.