Config Change Template - Seek & Destroy

Question

Over the years our network infrastructure has been managed by multiple people and they have all had different ideas on what usernames/accounts should be configured on our layer 2/3 equipment. I'd like to search for any usernames that don't equal "X" and if any do exist, run the appropriate "delete user" command to kill it. Is this possible?

jkrenzien · Answer

Using regex, this is fairly simple and can be adapting to several other things (like ntp servers).

Below is a screenshot of my scrubbed rule. The important part is the config block start.

^username (?!admin\s|support\s)\w*

Basically it means: If a line starts with "username " and is not followed by "admin " or "support " (negative forward lookup is the term I believe) and then some other work it is the start of the config block.

I put \s after each username to ensure I make no mistakes with the correct user name. Let me know if this helps or if you need further help with it.

dave_ent · Answer

Let me double-check my config templates.

joshuamichaelsanders · Answer

So, create a rule that says look for say, Cisco........where username1 is what I would want to keep and anything else I'd want to get rid of.

String must contain "username"

String must not contain "username <username1>"

How do I automatically remediate it with a snippit if I don't know what the erroneous usernames will be?