Configure a Remote Backup Schedule

Trung bìnhCấp 1Xem xét thủ côngcisco-nxos

Mô tả

NX-OS can be configured to initiate remote backups using scheduled jobs. This recommendation can also be satisfied (and likely satisfied better) using a host based backup tool, using SSH or SCP. Remote backups are preferred over local backups, as an attacker that has compromised a device also has full access to any locally stored files (which local backups are). CIS assessment: Manual. Reported as SKIP with review instructions.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

CIS assessment: Manual. switch# sho scheduler config

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

! Note that this first example job uses tftp for backups. The risk here is that the backup is sent in clear-text, so can be intercepted and/or modified in transit. Scheduler job name [backup-cfg] switch(config-job)copy running-config tftp://1.2.3.4/$(SWITCHNAME)-cfg.$(TIMESTAMP) vrf management This example job uses SCP. The risk here is that the credentials need to be embedded in the configuration, so can be recovered if the backup repository is compromised. As this is true for all local passwords, the risk may be deemed low in some organizations. scheduler aaa-authentication username <username> password <some complex password> Scheduler job name <backup-cfg> switch(config-job)copy running-config scp://1.2.3.4/$(SWITCHNAME)-cfg.$(TIMESTAMP) vrf management Whatever the protocol, set timetable for this backup scheduler schedule name [backups] schedule name [backups] job name <backup-cfg> time weekly [day 00:00] While this can certainly work, if the backup server IP should ever change, the effort to fix this across multiple switches can be both error-prone and time-intensive. It is normally recommended to backup configurations from the backup server to the NX-OS switch over SSH or SCP, rather than from the switch to the host. As this config (host to switch) resides on the remote host, it cannot be audited from the switch.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: cisco-nxosnetworklogging
Tham chiếu: CIS Cisco NX-OS Benchmark v1.2.0 - 4.2 Configure a Remote Backup Schedule