Logs from the CLI

[Jack_Howells]

We've had suspicions that there have been logins from an unknown source via the console.

"User admin logged in via CLI from Console"

None of the team have stated they logged in around 1am to the box, and the room is locked with a pin.

Is there anyway, apart from comparing configurations, and seeing what admins have logged on (I only have one admin user account), that I could potentially see what the activity was of the user that logged in? I.e what commands they ran in the CLI?

I don't believe there is a way, but would like to know people's thoughts.

Cheers

Jack

[Jack_Howells]

The first picture shows the time of the login, and the second picture shows access requests into where the Palo is installed.

[reaper]

config changes will be stored in the config log, furthermore you could review executed 'runtime' commands by logging into the cli and using the 'up' arrow to review all issued commands (up to about 40 previously executed commands are stored in history) in case only some debug commands were executed.

I'd recommend setting up several different (personalized if possible) administrator accounts which you can grant more/less access than that person or group requires, you can even disable CLI access for accounts

[nikoo]

Could this be your issue?

https://m.reddit.com/r/networking/comments/4oi72x/palo_alto_owners_get_any_unexpected_logins_from/

Quote from the topic:

Thank you for contacting Palo Alto Networks tech support. We have confirmed this affects only 3K platforms. Engineering is working on BUG-98344 to fix this cosmetic issue and it will not occur with installing further dynamic updates.

[Jack_Howells]

Reaper, thanks for the reply, that is what will need carrying out in future for sure.

Vieplis, ah, thank you! This seems very relevant. I will have to keep an eye on this.

Thanks

Jack