1.1.7 Set 'aaa accounting' to log all privileged use commands using 'commands 15'

Information

Runs accounting for all commands at the specified privilege level.

Rationale:

Authentication, authorization and accounting (AAA) systems provide an authoritative source for managing and monitoring access for devices. Centralizing control improves consistency of access control, the services that may be accessed once authenticated and accountability by tracking services accessed. Additionally, centralizing access control simplifies and reduces administrative costs of account provisioning and de-provisioning, especially when managing a large number of devices. AAA Accounting provides a management and audit trail for user and administrative sessions through RADIUS or TACACS+.

Impact:

Enabling 'aaa accounting' for privileged commands records and sends activity to the accounting servers and enables organizations to monitor and analyze privileged activity.

Solution

Configure AAA accounting for commands.

hostname(config)#aaa accounting commands 15 {default | list-name | guarantee-first}
{start-stop | stop-only | none} {radius | group group-name}

Default Value:

AAA accounting is disabled.

Additional Information:

Valid privilege level entries are integers from 0 through 15.

See Also

https://workbench.cisecurity.org/files/3762

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, CSCv6|5, CSCv7|5.1

Plugin: Cisco

Control ID: a006536195d14047c8cea6153aba8efad166bf62ee2d8ef9eec0899b877ad207