Set 'access-class' for 'line vty'

HochStufe 1Automatisiertcisco-ios

Beschreibung

The 'access-class' setting restricts incoming and outgoing connections between a particular vty (into a Cisco device) and the networking devices associated with addresses in an access list. Restricting the type of network devices, associated with the addresses on the access-list, further restricts remote access to those devices authorized to manage the device and reduces the risk of unauthorized access. Fails if any 'line vty' block has no 'access-class <acl> in'. Audited against the output of 'show running-config' (run 'terminal length 0' first; do not use 'show running-config all' or 'show startup-config').

So wird geprüft

Prüfmethode: Konfigurationsmuster

Muster: (?m)^line vty[^\n]*\n(?:[ \t]+(?:$|[^a \t\n]|a(?:$|[^c\n]|c(?:$|[^c\n]|c(?:$|[^e\n]|e(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^\-\n]|-(?:$|[^c\n]|c(?:$|[^l\n]|l(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^ \n])))))))))))))[^\n]*\n)*(?:[^ \t]|\z)

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

! Configure remote management access control restrictions for all VTY lines. line vty <line-number> <ending-line-number> access-class <vty_acl_number> in

Eigenschaften

Betriebssysteme: Beliebig
Tags: cisco-iosnetworkaaa
Referenz: CIS Cisco IOS XE 17.x Benchmark v2.2.1 - 1.2.5 Set 'access-class' for 'line vty'

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target cisco-ios