close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Overview
play_arrow Configuring Administrative Credentials and Privileges
- Understanding the Associated Password Rules for an Authorized Administrator
- Configuring a Common Criteria Authorized Administrator
play_arrow Configuring Network Time Protocol
- Configuring Network Time Protocol
play_arrow Configuring Roles and Authentication Methods
play_arrow Configuring SSH and Console Connection
play_arrow Configuring the Remote Syslog Server
- Sample Syslog Server Configuration on a Linux System
play_arrow Configuring Audit Log Options
- Configuring Audit Log Options in the Evaluated Configuration
- Sample Code Audits of Configuration Changes
play_arrow Configuring Event Logging
play_arrow Configuring VPNs
- Configuring VPN on a Device Running Junos OS
play_arrow Configuring Security Flow Policies
- Understanding a Security Flow Policy on a Device Running Junos OS
play_arrow Configuring Traffic Filtering Rules
play_arrow Configuring Network Attacks
play_arrow Configuring the IDP Extended Package
- IDP Extended Package Configuration Overview
play_arrow Configuring Cluster Mode
play_arrow Performing Self-Tests on a Device
- Understanding FIPS Self-Tests
play_arrow Configuration Statements
play_arrow Junos-FIPS Configuration Restrictions

list Table of Contents

English

Sample Syslog Server Configuration on a Linux System

date_range 02-Dec-23

arrow_backward

arrow_forward

Sample Syslog Server Configuration on a Linux System Overview

A secure Junos OS environment requires auditing of events and storing them in a local audit file. The recorded events are simultaneously sent to an external syslog server. A syslog server receives the syslog messages streamed from the device. The syslog server must have an SSH client with NETCONF support configured to receive the streamed syslog messages.

The NDcPP2.2e logs capture the events, few of them are listed below:

Committed changes
Login and logout of users
Failure to establish an SSH session
Establishment or termination of an SSH session
Changes to the system time

The following procedure is an example to show how to configure a syslog server on a Linux platform using the StrongSwan configuration to provide IPsec. Before you begin, the Linux-based syslog server must be configured with the IP address and gateway, and the StrongSwan IPsec client must be installed on the syslog server to initiate a VPN connection with the Junos OS device.

To setup a StrongSwan configuration on the remote syslog server to provide IPsec VPN capability:

Modify the /etc/ipsec.secrets settings in accordance with the Junos OS device configuration.
```
root@host# vi /etc/ipsec.secrets 192.168.1.2 192.168.1.1 : PSK “12345”
```

Modify the /etc/ipsec.conf settings in accordance with the Junos OS device configuration.

content_copy zoom_out_map
root@host# vi /etc/ipsec.conf
config setup
                charondebug="ike 4, cfg 4, chd 4, enc 1, net 4, knl 4, dmn 4"
conn %default
              ikelifetime=240
				keylife=300
				rekeymargin=10s
				keyingtries=%forever
				mobike=no
conn home
              keyexchange=ikev1
				authby=psk
				ike=aes128-sha256-modp2048!
				esp=aes128-sha1-modp2048!
				left=192.168.1.2 # self if
				leftsubnet=203.0.113.1/24 # self net for proxy id
				leftid=192.168.1.2 # self id
				right=192.168.1.1 # peer if
				rightsubnet=192.168.2.0/24 # peer net for proxy id
				rightid=192.168.1.1 # peer id
				auto=add
				leftfirewall=yes
				dpdaction=restart
				dpddelay=10
				dpdtimeout=120
				rekeyfuzz=10%
				reauth=no

Note:

Here conn home specifies the name of the IPSec tunnel connection to be established between a Junos OS device and Strongswan VPN Client on Syslog server, ike=aes-sha256-modp2048 specifies the IKE encryption and authentication algorithms and DH Group to be used for the connection, andesp=aes128-sha1 specifies the ESP encryption and authentication algorithms to be used for the connection.

Activate IPsec service by using ipsec up <being-established-ipsec-tunnel-name> command. For example,

content_copy zoom_out_map
[root@host]# ipsec up home
002 "home" #3: initiating Main Mode
104 "home" #3: STATE_MAIN_I1: initiate
010 "home" #3: STATE_MAIN_I1: retransmission; will wait 20s for response

Restart the IPsec StrongSwan service.
```
root@host# ipsec restart
```

Check for syslog encrypted traffic.

content_copy zoom_out_map
root@host# tcpdump –I eth1 –vv –s 1500 –c 10 –o /var/tmp/Syslog_Traffic.pcap

Copy /var/log/syslog to /var/tmp/syslog_verify file on the syslog server to validate the syslog from the Junos OS device.
```
root@host# cp /var/log/syslog /var/tmp/syslog_verify
```

Configuring Event Logging to a Local File

You can configure storing of audit information to a local file and the level of detail to be recorded with the syslog statement. This example stores logs in a file named Audit_file

content_copy zoom_out_map
[edit system]
syslog {
    file Audit_file;
}

Configuring Event Logging to a Remote Server

Configure the export of audit information to a secure, remote server by setting up an event trace monitor that sends event log messages by using NETCONF over SSH to the remote system event logging server. The following procedures show the configuration needed to send system log messages to a secure external server by using NETCONF over SSH.

Configuring Event Logging to a Remote Server when Initiating the Connection from the Remote Server

The following procedure describes the steps to configure event logging to a remote server when the SSH connection to the TOE is initiated from the remote system log server.

Generate an RSA public key on the remote syslog server.
```
$ ssh-keygen -b 2048 -t rsa -C 'syslog-monitor key pair' -f ~/.ssh/syslog-monitor
```
You will be prompted to enter the desired passphrase. The storage location for the syslog-monitor key pair is displayed.
On the TOE, create a class named monitor that has permission to trace events.
```
[edit]
user@host# set system login class monitor permissions trace
```
Create a user named syslog-mon with the class monitor, and with authentication that uses the syslog-monitor key pair from the key pair file located on the remote syslog server.
```
[edit]
user@host# set system login user syslog-mon class monitor authentication ssh-rsa “ssh-rsa xxxxx syslog-monitor key pair”
```

Set up NETCONF with SSH.

content_copy zoom_out_map
[edit]
user@host# set system services netconf ssh

Configure syslog to log all the messages at /var/log/messages.
```
[edit]
user@host# set system syslog file Audit_file any any
user@host# commit
```
On the remote system log server, start up the SSH agent. The start up is required to simplify the handling of the syslog-monitor key.
```
$ eval `ssh-agent`
```
On the remote syslog server, add the syslog-monitor key pair to the SSH agent.
```
$ ssh-add ~/.ssh/syslog-monitor
```
You will be prompted to enter the desired passphrase. Enter the same passphrase used in Step 1.
After logging in to the external_syslog_server session, establish a tunnel to the device and start NETCONF.
```
$ ssh syslog-mon@NDcPP_TOE -s netconf > test.out 
```
After NETCONF is established, configure a system log events message stream. This RPC will cause the NETCONF service to start transmitting messages over the SSH connection that is established.
```
<rpc><get-syslog-events><stream>messages</stream></get-syslog-events></rpc>
```
The examples for syslog messages are listed below. Monitor the event log generated for admin actions on TOE as received on the syslog server. Examine the traffic that passes between the audit server and the TOE, observing that these data are not viewed during this transfer, and that they are successfully received by the audit server. Match the logs between local event and the remote event logged in a syslog server and record the particular software (such as name, version, and so on) used on the audit server during testing.

The following output shows test log results for syslog server.

content_copy zoom_out_map
host@ssh-keygen -b 2048 -t rsa -C 'syslog-monitor key pair' -f ~/.ssh/syslog-monitor 
Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/host/.ssh/syslog-monitor.
Your public key has been saved in /home/host/.ssh/syslog-monitor.pub.
The key fingerprint is:
ef:75:d7:68:c5:ad:8d:6f:5e:7a:7e:9b:3d:f1:4d:3f syslog-monitor key pair
The key's randomart image is:
+--[ RSA 2048]----+
|                 |
|                 |
|                 |
|               ..|
|        S       +|
|         .     Bo|
|          . . *.X|
|         . . o E@|
|          .   .BX|
+-----------------+
[host@linux]$ cat /home/host/.ssh/syslog-monitor.pub
ssh-rsa
 AAAAB3NzaC1yc2EAAAADAQABAAABAQCrUREJUBpjwAoIgRrGy9zgt+
D2pikk3Q/Wdf8I5vr+njeqJhCx2bUAkrRbYXNILQQAZbg7kLfi/8TqqL
eon4HOP2e6oCSorKdx/GrOTzLONL4fh0EyuSAk8bs5JuwWNBUokV025
gzpGFsBusGnlj6wqqJ/sjFsMmfxyCkbY+pUWb8m1/A9YjOFT+6esw+9S
tF6Gbg+VpbYYk/Oday4z+z7tQHRFSrxj2G92aoliVDBLJparEMBc8w
LdSUDxmgBTM2oadOmm+kreBUQjrmr6775RJn9H9YwIxKOxGm4SFnX/Vl4
R+lZ9RqmKH2wodIEM34K0wXEHzAzNZ01oLmaAVqT 
syslog-monitor key pair
[host@linux]$ eval `ssh-agent`
Agent pid 1453
[host@linux]$ ssh-add ~/.ssh/syslog-monitor
Enter passphrase for /home/host/.ssh/syslog-monitor: 
Identity added: /home/host/.ssh/syslog-monitor (/home/host/.ssh/syslog-monitor)

content_copy zoom_out_map
host@linux]$ ssh syslog-mon@starfire -s netconf > test.out
host@linux]$ cat test.out
this is NDcPP test device

<!-- No zombies were killed during the creation of this user interface --
<!-- user syslog-mon, class j-monitor -><hello>
  <capabilities>	
    <capability>urn:ietf:params:xml:ns:netconf:base:1.0</capability>
    <capability>urn:ietf:params:xml:ns:netconf:capability:candidate:1.0</capability>
    <capability>urn:ietf:params:xml:ns:netconf:capability:confirmed-commit:1.0</capability>
    <capability>urn:ietf:params:xml:ns:netconf:capability:validate:1.0</capability>
    <capability>urn:ietf:params:xml:ns:netconf:capability:url:1.0?protocol=http,ftp,file</capability>
    <capability>http://xml.juniper.net/netconf/junos/1.0</capability>
    <capability>http://xml.juniper.net/dmi/system/1.0</capability>
  </capabilities>
  <session-id4129/session-id>
</hello>
]]>]]>

The following output shows event logs generated on the TOE that are received on the syslog server.

content_copy zoom_out_map
Jan 20 17:04:51  starfire sshd[4182]: error: Could not load host key: /etc/ssh/ssh_host_dsa_key
Jan 20 17:04:51  starfire sshd[4182]: error: Could not load host key: /etc/ssh/ssh_host_ecdsa_key
Jan 20 17:04:53  starfire sshd[4182]: Accepted password for sec-admin from 10.209.11.24 port 55571 ssh2
Jan 20 17:04:53  starfire mgd[4186]: UI_AUTH_EVENT: Authenticated user 'sec-admin' at permission level 'j-administrator'
Jan 20 17:04:53  starfire mgd[4186]: UI_LOGIN_EVENT: User 'sec-admin' login, class 'j-administrator' [4186], ssh-connection '10.209.11.24 55571 10.209.14.92 22', client-mode 'cli'

The following output shows that the local syslogs and remote syslogs received are similar.

content_copy zoom_out_map
Local : an 20 17:09:30  starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: Redundancy interface management process checking new configuration
Jan 20 17:09:30  starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/rdd'
Jan 20 17:09:30  starfire mgd[4186]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/rdd', PID 4317, status 0
Jan 20 17:09:30  starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: Dynamic flow capture service checking new configuration
Jan 20 17:09:30  starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/dfcd'
Jan 20 17:09:30  starfire mgd[4186]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/dfcd', PID 4318, status 0
Jan 20 17:09:30  starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: Connectivity fault management process checking new configuration
Jan 20 17:09:30  starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/cfmd'
Jan 20 17:09:30  starfire mgd[4186]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/cfmd', PID 4319, status 0
Jan 20 17:09:30  starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: Layer 2 address flooding and learning process checking new configuration
Jan 20 17:09:30  starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/l2ald'
Jan 20 17:09:30  starfire mgd[4186]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/l2ald', PID 4320, status 0
Jan 20 17:09:30  starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: Layer 2 Control Protocol process checking new configuration
Jan 20 17:09:30  starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/l2cpd'
Jan 20 17:09:30  starfire l2cp[4321]: Initializing PNAC state machines
Jan 20 17:09:30  starfire l2cp[4321]: Initializing PNAC state machines complete
Jan 20 17:09:30  starfire l2cp[4321]: Initialized 802.1X module and state machinesJan 20 17:09:30  starfire l2cp[4321]: Read acess profile () config
Jan 20 17:09:30  starfire mgd[4186]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/l2cpd', PID 4321, status 0
Jan 20 17:09:30  starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: Multicast Snooping process checking new configuration
Jan 20 17:09:30  starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/mcsnoopd'
Jan 20 17:09:30  starfire mgd[4186]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/mcsnoopd', PID 4325, status 0
Jan 20 17:09:30  starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: commit wrapup...
Jan 20 17:09:30  starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: activating '/var/etc/ntp.conf'
Jan 20 17:09:30  starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: start ffp activate
Jan 20 17:09:30  starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/ffp'
Jan 20 17:09:30  starfire ffp[4326]: "dynamic-profiles": No change to profiles....................................

content_copy zoom_out_map
Remote : an 20 17:09:30  starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: Redundancy interface management process checking new configuration
Jan 20 17:09:30  starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/rdd'
Jan 20 17:09:30  starfire mgd[4186]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/rdd', PID 4317, status 0
Jan 20 17:09:30  starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: Dynamic flow capture service checking new configuration
Jan 20 17:09:30  starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/dfcd'
Jan 20 17:09:30  starfire mgd[4186]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/dfcd', PID 4318, status 0
Jan 20 17:09:30  starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: Connectivity fault management process checking new configuration
Jan 20 17:09:30  starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/cfmd'
Jan 20 17:09:30  starfire mgd[4186]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/cfmd', PID 4319, status 0
Jan 20 17:09:30  starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: Layer 2 address flooding and learning process checking new configuration
Jan 20 17:09:30  starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/l2ald'
Jan 20 17:09:30  starfire mgd[4186]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/l2ald', PID 4320, status 0
Jan 20 17:09:30  starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: Layer 2 Control Protocol process checking new configuration
Jan 20 17:09:30  starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/l2cpd'
Jan 20 17:09:30  starfire l2cp[4321]: Initializing PNAC state machines
Jan 20 17:09:30  starfire l2cp[4321]: Initializing PNAC state machines complete
Jan 20 17:09:30  starfire l2cp[4321]: Initialized 802.1X module and state machinesJan 20 17:09:30  starfire l2cp[4321]: Read acess profile () config
Jan 20 17:09:30  starfire mgd[4186]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/l2cpd', PID 4321, status 0
Jan 20 17:09:30  starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: Multicast Snooping process checking new configuration
Jan 20 17:09:30  starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/mcsnoopd'
Jan 20 17:09:30  starfire mgd[4186]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/mcsnoopd', PID 4325, status 0
Jan 20 17:09:30  starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: commit wrapup...
Jan 20 17:09:30  starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: activating '/var/etc/ntp.conf'
Jan 20 17:09:30  starfire mgd[4186]: UI_COMMIT_PROGRESS: Commit operation in progress: start ffp activate
Jan 20 17:09:30  starfire mgd[4186]: UI_CHILD_START: Starting child '/usr/sbin/ffp'
Jan 20 17:09:30  starfire ffp[4326]: "dynamic-profiles": No change to profiles ...............  

If the connections used by the device is unintentionally broken, the security administrator needs to restart the connection, or the device will try to re-connect with the audit server.

arrow_backward PREVIOUS Configuring SSH on the Evaluated Configuration

NEXT arrow_forward Configuring Audit Log Options in the Evaluated Configuration

Common Criteria Guide for vSRX3.0

ON THIS PAGE