Re: Desktop Support Access

[khayes () eastbay com]

I really don't think you can do it at the IOS level but you may be able to
do it using something like Cisco Works.  CW allows different level users
and you may be able to dictate which commands they can issue through
CiscoView.  This would keep them off the CLI and it also gives them a nice
easy to use GUI.  My biggest fear would be someone screwing up a command
and doing more than just manipulating ports.

On some versions of IOS I know you can have different user accounts created
to permit login.  Each of the accounts can have their own passwords.  It
may be worth it if the logs pick up on which account committed the changes.

Big suggestion though... keep daily copies of your logs.  If someone
accidental screws over a config recovery would be as simple as replacing it
with last nights known good config.  Worst case scenario, go back a few
days.

Don't forget to make it a requirement that they document ANYTHING they
change and give you notice of the change.

Ken Hayes
Network Administrator
Eastbay / Footlocker.com
Wausau, WI Offices
(715) 261-9573
khayes () eastbay com



                                                                                                                        
             
                                                                                                                        
             
                                                                                                                        
             
                                                                                                                        
             
                                       To:     "Thomas Graf" <tgraf () swmail sw org>, <security-basics () 
securityfocus com>              
                                       cc:                                                                              
             
              "David Nichols"          Subject:  Re: Desktop Support Access                                             
             
              <dnichols () amci com>                                                                                    
                
                                                                                                                        
             
              10/17/2003 12:44 PM                                                                                       
             
                                                                                                                        
             




Hey Thomas (& the rest of the list)-

Correct me if I'm wrong, (please!, I've gone through a CCNA course but
haven't taken the test yet!) but I think the IOS only has two levels of
access, one to basically monitor and the other to admin the router.  If
this
is the case, I think you're out of luck.  Does any one know of any software
(simulator-like) that will only allow certain commands to be passed on to
the router?  If not, I'M CALLING THE PATENT OFFICE RIGHT NOW!! (just
kidding)  ; )

David Nichols
A+, Network+

----- Original Message (edited) -----
From: "Thomas Graf" <tgraf () swmail sw org>
To: <security-basics () securityfocus com>
Sent: Friday, October 17, 2003 10:22 AM
Subject: Desktop Support Access


> ... The desktop support is requesting access to (Cisco) routers and
switches to enable/disable
> ports.  (...)   I know that they are going to get it and it is a big
risk,
but is there any way to
> limit there access to just enabling/disabling ports?
>
> Thanks for all the help.
>
> Thomas Graf
> HW/SW Technician



---------------------------------------------------------------------------
FREE Whitepaper: Better Management for Network Security

Looking for a better way to manage your IP security?
Learn how Solsoft can help you:
- Ensure robust IP security through policy-based management
- Make firewall, VPN, and NAT rules interoperable across heterogeneous
networks
- Quickly respond to network events from a central console

Download our FREE whitepaper at:
http://www.securityfocus.com/sponsor/Solsoft_security-basics_031015
----------------------------------------------------------------------------







---------------------------------------------------------------------------
FREE Whitepaper: Better Management for Network Security

Looking for a better way to manage your IP security?
Learn how Solsoft can help you:
- Ensure robust IP security through policy-based management
- Make firewall, VPN, and NAT rules interoperable across heterogeneous
networks
- Quickly respond to network events from a central console

Download our FREE whitepaper at:
http://www.securityfocus.com/sponsor/Solsoft_security-basics_031015
----------------------------------------------------------------------------