TMA-CISCO-ASA-1.4.3.1
Ensure 'aaa authentication enable console' is configured correctly
Description
Authenticates users trying to access the Enable mode (privileged EXEC mode) through the 'enable' command. The default access to enable mode is done through a password. AAA provides a primary method for authenticating users (a username/password database stored on a TACACS+ or RADIUS server or group of servers) and then specifies backup method (a locally stored ... Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).
How it is checked
Audit method: Configuration pattern
- Pattern
(?m)^aaa authentication enable console \S
How it is fixed
Fix method: Guidance or infrastructure patch
! Configure the aaa authentication for enable access using the TACACS+ server-group as primary method and the local database as backup method aaa authentication enable console <server-group_name> local
Properties
- Operating systems
- Any
- Tags
- cisco-asanetworkaaa
- Reference
- CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 1.4.3.1 Ensure 'aaa authentication enable console' is configured correctly
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target cisco-asa