Debug mode enabled-cisco-nxos

Debug mode enabled-cisco-nxos
0

Debug mode enabled-cisco-nxos

Vendor: cisco

OS: nxos

Description:
Indeni will alert if one of the debug mechanisms on a device is enabled when the default is for it to be disabled.

Remediation Steps:
Turn off the debug as soon as possible.

How does this work?
This script logs in to the Cisco Nexus switch using SSH and retrieves the status of running debugs. In normal operation there should not be any debugs enabled.

Why is this important?
Enabling debugging on a Cisco Nexus device enables the system administrator to get low-level information about the system’s operation. This functionality is often used for troubleshooting and it has a high potential impact on CPU utilization and system stability. It is highly undesirable to keep debugging enabled for extended periods of time.

Without Indeni how would you find this?
An administrator would detect enabled debugging by logging in to the device or by monitoring syslog messages in case debug level logging has been enabled.

nexus-show-debug

name: nexus-show-debug
description: Nexus show debug
type: monitoring
monitoring_interval: 59 minutes
requires:
    vendor: cisco
    os.name: nxos
comments:
    debug-status:
        why: |
            Enabling debugging on a Cisco Nexus device enables the system administrator to get low-level information about the system's operation. This functionality is often used for troubleshooting and it has a high potential impact on CPU utilization and system stability. It is highly undesirable to keep debugging enabled for extended periods of time.
        how: |
            This script logs in to the Cisco Nexus switch using SSH and retrieves the status of running debugs. In normal operation there should not be any debugs enabled.
        without-indeni: |
            An administrator would detect enabled debugging by logging in to the device or by monitoring syslog messages in case debug level logging has been enabled.
        can-with-snmp: false
        can-with-syslog: true
steps:
-   run:
        type: SSH
        command: show debug
    parse:
        type: AWK
        file: show_debug.parser.1.awk

cross_vendor_debug_on_vsx

// Deprecation warning : Scala template-based rules are deprecated. Please use YAML format rules instead.

package com.indeni.server.rules.library.templatebased.crossvendor

import com.indeni.server.rules.RuleContext
import com.indeni.server.rules.library.templates.StateDownTemplateRule
import com.indeni.server.rules.RemediationStepCondition
import com.indeni.server.common.data.conditions.Equals

/**
  *
  */
case class cross_vendor_debug_on_vsx() extends StateDownTemplateRule(
  ruleName = "cross_vendor_debug_on_vsx",
  ruleFriendlyName = "All Devices (VSX): Debug mode enabled",
  ruleDescription = "Indeni will alert if one of the debug mechanisms on a device is enabled when the default is for it to be disabled.",
  metricName = "debug-status",
  applicableMetricTag = "vs.name",
  alertIfDown = false,
  alertItemsHeader = "Debugs Enabled",
  alertDescription = "One or more debug flags or components is enabled. Leaving debug on for too long may result in performance issues.",
  baseRemediationText = "Turn off the debug as soon as possible.",
  itemSpecificDescription = Seq(
    "^watchdog$".r -> "In the event of a system lock-up, the watchdog process ensures that the BIG-IP system restarts and fails over. In order to force the BIG-IP system to produce a core file for diagnostic purposes, administrators must disable the watchdog process to allow the core file to be written to disk before the system restarts. Re-enable the watchdog.",
    "^mcpd-force-reload$".r -> "If /service/mcpd/forceload exists any reboot would take longer than usual. In case of an outage together with a degraded cluster this could mean increased downtime in case a cluster member is restarted.",
    "^tm\\.rstcause\\.log$".r -> "Enabling RST cause logging uses additional system resources when connections are reset. This can be used for additional traction by an attacked performing a DDOS attack. This is not recommended to leave enabled unless it is for troubleshooting purposes.",
    "^tm\\.rstcause\\.pkt$".r -> "Enabling RST cause information in the packet payload may disclose details about your environment to a potential attacker. This is not recommended to leave enabled unless it is for troubleshooting purposes.",
    "^tcpdump$".r -> "Packet sniffer, useful for troubleshooting network issues. Left on it can result in performance issues.",
    "^firewall kernel debug - process kdebug/zdebug$".r -> "Debug proccess is running. Left on it can result in performance issues.",
    "^firewall kernel debug.*module$".r -> "One or more debug flags are not in default values. Left on it can result in wrong debugging process in future",
    "^firewall kernel debug - process tcpdump$".r -> "Packet sniffer, useful for troubleshooting network issues. Left on it can result in performance issues.",
    "^fwaccel debug.*module$".r -> "One or more SecureXL debug flags are not in default values. Left on it can result in wrong debugging process in future",
    "^fwaccel debug - filter status$".r -> "SecureXL debug filter is not in default value. Left on it can result in wrong debugging process in future",
    ".*".r -> ""
  ),
   metaCondition = Equals("vsx", "true")
)(
  RemediationStepCondition.VENDOR_CP -> "If the above list includes kernel debugging, run \"fw ctl debug 0\" to clear the debugs."
)