Dell OS10 CMD_EXEC

The CMD_EXEC check runs a command and analyzes the output with regular expressions to identify if a command matches the expected output.

If the CMD_EXEC is used in an offline scan, a warning will be posted stating that the command is not able to run in offline mode.

Usage

<custom_item>

type : CMD_EXEC

description : ["description"]

cmd : ["command to run"]

(optional) regex : ["regular expression to reduce config options"]

expect : ["regular expression that passes if found"]

not_expect : ["regular expression that passes if not found"]

(optional) match_all : [YES|NO]

(optional) match_case : [YES|NO]

</custom_item>

cmd

The cmd is the command that should be run on the target.

Only show commands are allowed for security reasons. Attempts to execute other commands will result in error like the following:

ERROR: Only show commands are supported in the CMD_EXEC: configure terminal

regex

(Optional) The regex is used to filter the full configurations to a smaller set of lines of text based on the regular expression. Multiple regex can be used to narrow down the searchable configuration.

expect and not_expect

The evaluation is based on expect or not_expect. Only one of these fields can exist in a check.

  • For expect, if the regular expression matches a line of text, the check results as PASSED. If there are no matches, the check results as FAILED.

  • For not_expect, if the regular expression matches a line of text, the check results as FAILED. If there are no matches, the check results as PASSED.

To indicate if all lines need to match or that lines are case-sensitive, use the modifiers match_all or match_case.

match_all

(Optional) Setting match_all to YES requires the expectation to match all lines of text, and not just a single line of text. If match_all is set to the default of NO, only one line must match for the check to pass.

match_case

(Optional) Setting match_case to YES makes the comparison to be case sensitive. If match_case is set to the default of NO, the comparison is case insensitive.

Offline Mode Behavior

When running in offline mode, CMD_EXEC checks generate warnings:

WARNING: Command not able to run in offline mode.

Example

<custom_item>

type : CMD_EXEC

description : "Ensure '3ds-cbc' is disabled for SSH access"

cmd : "show running-config"

regex : "ssh server encryption"

expect : "ssh server encryption 3des-cbc disable"

</custom_item>