Configure a Remote Backup Schedule

OrtaDüzey 1Manuel incelemecisco-nxos

Açıklama

NX-OS can be configured to initiate remote backups using scheduled jobs. This recommendation can also be satisfied (and likely satisfied better) using a host based backup tool, using SSH or SCP. Remote backups are preferred over local backups, as an attacker that has compromised a device also has full access to any locally stored files (which local backups are). CIS assessment: Manual. Reported as SKIP with review instructions.

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

CIS assessment: Manual. switch# sho scheduler config

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

! Note that this first example job uses tftp for backups. The risk here is that the backup is sent in clear-text, so can be intercepted and/or modified in transit. Scheduler job name [backup-cfg] switch(config-job)copy running-config tftp://1.2.3.4/$(SWITCHNAME)-cfg.$(TIMESTAMP) vrf management This example job uses SCP. The risk here is that the credentials need to be embedded in the configuration, so can be recovered if the backup repository is compromised. As this is true for all local passwords, the risk may be deemed low in some organizations. scheduler aaa-authentication username <username> password <some complex password> Scheduler job name <backup-cfg> switch(config-job)copy running-config scp://1.2.3.4/$(SWITCHNAME)-cfg.$(TIMESTAMP) vrf management Whatever the protocol, set timetable for this backup scheduler schedule name [backups] schedule name [backups] job name <backup-cfg> time weekly [day 00:00] While this can certainly work, if the backup server IP should ever change, the effort to fix this across multiple switches can be both error-prone and time-intensive. It is normally recommended to backup configurations from the backup server to the NX-OS switch over SSH or SCP, rather than from the switch to the host. As this config (host to switch) resides on the remote host, it cannot be audited from the switch.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: cisco-nxosnetworklogging
Referans: CIS Cisco NX-OS Benchmark v1.2.0 - 4.2 Configure a Remote Backup Schedule