Cisco ASA
TMA-CISCO-ASA-1.1.5
Ensure 'Password Policy' is enabled
Beschreibung
Enforces the Enterprise Password Policy by setting compliant local password requirements for the security appliance. The password policy helps to prevent unauthorized accesses by enforcing the password for more complexity and making them difficult to be guessed. This applies to the local database. Fails unless minimum-length (>= 14), uppercase, lowercase, numeric and special minimums are configured; also fails on lifetime > 365 (or 0) and minimum-changes < 14 when set. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).
So wird geprüft
Prüfmethode: Konfigurationsmuster
- Muster
(?m)(?:\A(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^l\n]|l(?:$|[^e\n]|e(?:$|[^n\n]|n(?:$|[^g\n]|g(?:$|[^t\n]|t(?:$|[^h\n]|h(?:$|[^ \n])))))))))))))))))))))))))))))))[^\n]*\n)*(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^l\n]|l(?:$|[^e\n]|e(?:$|[^n\n]|n(?:$|[^g\n]|g(?:$|[^t\n]|t(?:$|[^h\n]|h(?:$|[^ \n])))))))))))))))))))))))))))))))[^\n]*)?\z)|(?:\A(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^u\n]|u(?:$|[^p\n]|p(?:$|[^p\n]|p(?:$|[^e\n]|e(?:$|[^r\n]|r(?:$|[^c\n]|c(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^e\n]|e(?:$|[^ \n]))))))))))))))))))))))))))))))))))[^\n]*\n)*(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^u\n]|u(?:$|[^p\n]|p(?:$|[^p\n]|p(?:$|[^e\n]|e(?:$|[^r\n]|r(?:$|[^c\n]|c(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^e\n]|e(?:$|[^ \n]))))))))))))))))))))))))))))))))))[^\n]*)?\z)|(?:\A(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^l\n]|l(?:$|[^o\n]|o(?:$|[^w\n]|w(?:$|[^e\n]|e(?:$|[^r\n]|r(?:$|[^c\n]|c(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^e\n]|e(?:$|[^ \n]))))))))))))))))))))))))))))))))))[^\n]*\n)*(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^l\n]|l(?:$|[^o\n]|o(?:$|[^w\n]|w(?:$|[^e\n]|e(?:$|[^r\n]|r(?:$|[^c\n]|c(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^e\n]|e(?:$|[^ \n]))))))))))))))))))))))))))))))))))[^\n]*)?\z)|(?:\A(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^n\n]|n(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^e\n]|e(?:$|[^r\n]|r(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^ \n]))))))))))))))))))))))))))))))))[^\n]*\n)*(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^n\n]|n(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^e\n]|e(?:$|[^r\n]|r(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^ \n]))))))))))))))))))))))))))))))))[^\n]*)?\z)|(?:\A(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^s\n]|s(?:$|[^p\n]|p(?:$|[^e\n]|e(?:$|[^c\n]|c(?:$|[^i\n]|i(?:$|[^a\n]|a(?:$|[^l\n]|l(?:$|[^ \n]))))))))))))))))))))))))))))))))[^\n]*\n)*(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^s\n]|s(?:$|[^p\n]|p(?:$|[^e\n]|e(?:$|[^c\n]|c(?:$|[^i\n]|i(?:$|[^a\n]|a(?:$|[^l\n]|l(?:$|[^ \n]))))))))))))))))))))))))))))))))[^\n]*)?\z)|(?:^password-policy minimum-length (?:[0-9]|1[0-3])\s*$)|(?:^password-policy lifetime (?:0|36[6-9]|3[7-9]\d|[4-9]\d\d|\d{4,})\s*$)|(?:^password-policy minimum-changes (?:[0-9]|1[0-3])\s*$)|(?:^password-policy minimum-(?:uppercase|lowercase|numeric|special) 0\s*$)
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
! - Step 1: Run the following to set the password lifetime in days to less than or equal to 365 password-policy lifetime 365 - Step 2: Run the following to set the minimum number of characters that must be changed between the old and the new passwords, to be to be greater than or equal to 14 password-policy minimum-changes 14 - Step 3: Run the following to set the minimum number of upper case characters in the password, to be to be greater than or equal to 1 password-policy minimum-uppercase 1 - Step 4: Run the following to set the minimum number of lower case characters in the password, to be to be greater than or equal to 1 password-policy minimum-lowercase 1 - Step 5: Run the following to set the minimum number of numeric characters in the password, to be greater than or equal to 1 password-policy minimum-numeric 1 - Step 6: Run the following to set the minimum number of special characters in the password, to be greater than or equal to 1 password-policy minimum-special 1 - Step 7: Run the following to set the password minimum length, to be greater than or equal to 14 password-policy minimum-length 14
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- cisco-asanetworkaaa
- Referenz
- CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 1.1.5 Ensure 'Password Policy' is enabled
Diesen Host prüfen
Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.
tmaegis scan --target cisco-asa