Verify root login is disabled

HighLevel 1Automatedarista-eos

Description

EOS can be configured to allow logging in as root directly by using the aaa root secret config command. This should be not be enabled. An authenticated, authorized user can obtain superuser access after logging in by accessing the bash shell if permitted. Allowing remote root login bypasses the EOS cli and gives direct access to the bash shell. Audited against the output of 'show running-config' (not 'show running-config all').

How it is checked

Audit method: Configuration pattern

Pattern: (?m)^no aaa root\s*$

How it is fixed

Fix method: Guidance or infrastructure patch

! Reset to default value default aaa root

Properties

Operating systems: Any
Tags: arista-eosnetworklogging
Reference: CIS Arista EOS Benchmark v1.0.0 - 2.1.4 Verify root login is disabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target arista-eos