Configure a Remote Backup Schedule

SrednjaNivo 1Ručni pregledcisco-nxos

Opis

NX-OS can be configured to initiate remote backups using scheduled jobs. This recommendation can also be satisfied (and likely satisfied better) using a host based backup tool, using SSH or SCP. Remote backups are preferred over local backups, as an attacker that has compromised a device also has full access to any locally stored files (which local backups are). CIS assessment: Manual. Reported as SKIP with review instructions.

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

CIS assessment: Manual. switch# sho scheduler config

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

! Note that this first example job uses tftp for backups. The risk here is that the backup is sent in clear-text, so can be intercepted and/or modified in transit. Scheduler job name [backup-cfg] switch(config-job)copy running-config tftp://1.2.3.4/$(SWITCHNAME)-cfg.$(TIMESTAMP) vrf management This example job uses SCP. The risk here is that the credentials need to be embedded in the configuration, so can be recovered if the backup repository is compromised. As this is true for all local passwords, the risk may be deemed low in some organizations. scheduler aaa-authentication username <username> password <some complex password> Scheduler job name <backup-cfg> switch(config-job)copy running-config scp://1.2.3.4/$(SWITCHNAME)-cfg.$(TIMESTAMP) vrf management Whatever the protocol, set timetable for this backup scheduler schedule name [backups] schedule name [backups] job name <backup-cfg> time weekly [day 00:00] While this can certainly work, if the backup server IP should ever change, the effort to fix this across multiple switches can be both error-prone and time-intensive. It is normally recommended to backup configurations from the backup server to the NX-OS switch over SSH or SCP, rather than from the switch to the host. As this config (host to switch) resides on the remote host, it cannot be audited from the switch.

Svojstva

Operativni sistemi: Bilo koji
Oznake: cisco-nxosnetworklogging
Referenca: CIS Cisco NX-OS Benchmark v1.2.0 - 4.2 Configure a Remote Backup Schedule