Cisco Local Username Compliancy Check

It's easy to create a compliance rule that checks for a specific username on a Cisco device. (Config File --> Must contain --> Find string --> username <user>)

How do I create a compliance rule that ensures that there are no other usernames on each Cisco device on the network.

I have searched, but haven't found the answer yet.

Thanks!

Find more posts tagged with

Accepted answers

cnorborg

The basic same approach was part of a prior discussion. Might find more details there. I'll just refer you to that discussion rather than rehash it all here.

Filtering for incorrect logging hosts

All comments

christopher.a.thornton

I have one of these in place now actually, this is the compliance check that I use for usernames.

The below will check to ensure that the username is present with MD5 encrypted password. Just repeat this line for however many usernames you have present. Replace username with whatever the actual username is.

To ensure that no others are present use a rule like the below. Just replace username1, 2 etc with whatever the actual usernames that are supposed to be there are present.

The above 2 rules will flag any config if the names that are supposed to be there are not and if there are additional entries that are not supposed to be there. If you are using type 7 encryption then the first rule will need to be modified a bit to suit that though.

bigirukandji

I tried this, and put 'AND' in from of the second password line, and the "must not contain" line. When I click on submit, it says "Validation failed!" and "Check parenthesis incoditional statement. This does not check any parenthesis in a regular expression."

bigirukandji

I tried doing a parenthesis on the first two lines since they are both "must contain". When I click on submit it says "Multi-line patterns syntax error".

christopher.a.thornton

No need for parenthesis in the rule at all aside from in the regex part. It will apply both rules at the same time and flag them as failures accordingly. If you are still having issues get a screen grab of the rule and error and post it here so I can take a look.

christopher.a.thornton

It should look like the below when you are creating the rule.

CourtesyIT

Chris,

Keep in mind, if you are doing these for STIG purposes, there is only suppose to be one account locally configured for emergency access. Depending on your setup you if you need two or more an exception to policy letter may be required.

Thanks,

bigirukandji

OK, I got it working now. I deleted the rule, and re-created it the exact same way, and it worked. There must've been some kind of bug or something in the previous rule. My guess is that something happened when I added and removed lines, and somehow the rule got messed up.

Thanks everyone for your help!

CourtesyIT

do not forget to check you spacing and line returns. They are hidden and will affect the rule.

christopher.a.thornton

Glad you were able to get it working. That is weird that you had to delete it and recreate the rule though. As CourtseyIT said though there may have been an extra line return or space in there somewhere that could have caused that.

bigirukandji

While I was going through the issue and troubleshooting it, I did mess around with the spacing and line returns. There are only two lines, and I tried moving around the spacing in every way possible. I also wiped out the text in the box and retyped it. It was not a spacing or line return issue. I think there was some kind of bug or extra coding that got in there somehow (into the rule) that was preventing me from saving (submitting) it.