Cisco ASA
TMA-CISCO-ASA-1.10.2
Ensure 'logging to monitor' is disabled
MediumLevel 1Automatedcisco-asa
Description
Disables the logging to monitor. The ASA by default send logs to monitor for Telnet and SSH sessions. The logs messages will continuously scroll on the monitor after the "Terminal Monitor" command is issued. This consumes a lot of resources causing high CPU usage and should be avoided. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).
How it is checked
Audit method: Configuration pattern
- Pattern
(?m)^logging monitor\b
How it is fixed
Fix method: Guidance or infrastructure patch
! Run the following command to disable the logging monitor no logging monitor
Properties
- Operating systems
- Any
- Tags
- cisco-asanetworklogging
- Reference
- CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 1.10.2 Ensure 'logging to monitor' is disabled
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target cisco-asa