RE: tracking rogue dialup users [7:10859]
I dont actually use CiscoSecure ACS, but I would assume it does. I use the standard tacplus TACACS+ dameon and it keeps up with what number they dialed in from, time on, ip, and the bytes in and out to name a few things. Hope that helps Tim -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of - Sent: Tuesday, July 03, 2001 1:23 PM To: [EMAIL PROTECTED] Subject: tracking rogue dialup users [7:10859] Greetz. Just a matter of interest. Say there is user A, he dials up to ISP J. User A breaks into server X. Server X has the ip, he contacts the isp How is the user tracked from there on... Do servers like CiscoSecure ACS keep track of the ip and the time connected. The reason I am asking is in my little experience that I had with CiscoSecure ACS and their radius, I could not find such info on the logs. Is tacacs perhaps a little better, will it give me more info? Or will this user just get away with this -- Doubt it though Any help will be greatly appreciated. Ciao Message Posted at: http://www.groupstudy.com/form/read.php?f=7i=10863t=10859 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: tracking rogue dialup users [7:10859]
You tell the devices that are logging how specific you want them to be, regarding dates and minutes and all that. The parameter is 'timestamps'. This is also why you need to have a central timekeeping server that syncs your devices across the enterprise, so that the times make sense to everyone. NTP is used for this. Michael Le, CCIE #6811 --- - wrote: Greetz. Just a matter of interest. Say there is user A, he dials up to ISP J. User A breaks into server X. Server X has the ip, he contacts the isp How is the user tracked from there on... Do servers like CiscoSecure ACS keep track of the ip and the time connected. The reason I am asking is in my little experience that I had with CiscoSecure ACS and their radius, I could not find such info on the logs. Is tacacs perhaps a little better, will it give me more info? Or will this user just get away with this -- Doubt it though Any help will be greatly appreciated. Ciao [EMAIL PROTECTED] __ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/ Message Posted at: http://www.groupstudy.com/form/read.php?f=7i=10872t=10859 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
