lib: change command logging to be off by default
* lib/vty.c: add 'log_command' to enable logging of vty commands executed.
Default command logging to off.
diff --git a/doc/basic.texi b/doc/basic.texi
index 0f7bec9..4485665 100644
--- a/doc/basic.texi
+++ b/doc/basic.texi
@@ -185,6 +185,13 @@
millisecond accuracy.
@end deffn
+@deffn Command {log commands} {}
+This command enables the logging of all commands typed by a user to
+all enabled log destinations. The note that logging includes full
+command lines, including passwords. Once set, command logging can only
+be turned off by restarting the daemon.
+@end deffn
+
@deffn Command {service password-encryption} {}
Encrypt password.
@end deffn
diff --git a/lib/vty.c b/lib/vty.c
index e4510f8..ff013cf 100644
--- a/lib/vty.c
+++ b/lib/vty.c
@@ -90,6 +90,7 @@
/* Integrated configuration file path */
char integrate_default[] = SYSCONFDIR INTEGRATE_DEFAULT_CONFIG;
+static int do_log_commands = 0;
/* VTY standard output function. */
int
@@ -401,12 +402,13 @@
int ret;
vector vline;
const char *protocolname;
- char *cp;
+ char *cp = NULL;
/*
* Log non empty command lines
*/
- cp = buf;
+ if (do_log_commands)
+ cp = buf;
if (cp != NULL)
{
/* Skip white spaces. */
@@ -434,7 +436,7 @@
snprintf(prompt_str, sizeof(prompt_str), cmd_prompt (vty->node), vty_str);
/* now log the command */
- zlog(NULL, LOG_NOTICE, "%s%s", prompt_str, buf);
+ zlog(NULL, LOG_ERR, "%s%s", prompt_str, buf);
}
/* Split readline string up into the vector */
vline = cmd_make_strvec (buf);
@@ -2938,6 +2940,17 @@
return CMD_SUCCESS;
}
+/* vty login. */
+DEFUN (log_commands,
+ log_commands_cmd,
+ "log commands",
+ "Logging control\n"
+ "Log all commands (can't be unset without restart)\n")
+{
+ do_log_commands = 1;
+ return CMD_SUCCESS;
+}
+
/* Display current configuration. */
static int
vty_config_write (struct vty *vty)
@@ -2970,6 +2983,9 @@
vty_out (vty, " anonymous restricted%s", VTY_NEWLINE);
}
+ if (do_log_commands)
+ vty_out (vty, "log commands%s", VTY_NEWLINE);
+
vty_out (vty, "!%s", VTY_NEWLINE);
return CMD_SUCCESS;
@@ -3091,6 +3107,7 @@
install_element (CONFIG_NODE, &service_advanced_vty_cmd);
install_element (CONFIG_NODE, &no_service_advanced_vty_cmd);
install_element (CONFIG_NODE, &show_history_cmd);
+ install_element (CONFIG_NODE, &log_commands_cmd);
install_element (ENABLE_NODE, &terminal_monitor_cmd);
install_element (ENABLE_NODE, &terminal_no_monitor_cmd);
install_element (ENABLE_NODE, &no_terminal_monitor_cmd);