Logging Telnet Access

Problem

You want to log every Telnet session to the router.

Solution

To log every Telnet session to the router, use the followings set of commands:

Router1#configure terminal 
Enter configuration commands, one per line. End with CNTL/Z.
Router1(config)#access-list 90 permit any log
Router1(config)#line vty 0 4
Router1(config-line)#access-class 90 in
Router1(config-line)#exit
Router1(config)#end
Router1#

 

Discussion

Keeping detailed log records of every Telnet session that your router accepts can be useful for security purposes. By configuring an access-class ACL to log every session, the router will capture which IP source addresses attempt to access the Telnet port. Note, however, that this method will capture both successful and unsuccessful Telnet attempts, which is an invaluable capability.

Of course, you can combine this functionality with the other access-classes that we discussed in Recipes 3.15 and 3.16. This recipe doesn't introduce any new features, but rather a different way to use the same commands.

To view all captured Telnet attempts onto the router, use the following EXEC command:

Router1# show logging | include list 90
Jun 27 14:44:45: %SEC-6-IPACCESSLOGS: list 90 permitted 172.25.1.1 1 packet
Router1#

The logged messages will always show permitted, whether the session authentication was successful or not.

See Also

Recipe 3.15; Recipe 3.16