TMA-CISCO-ASA-1.4.3.2
Ensure 'aaa authentication http console' is configured correctly
HighLevel 1Automatedcisco-asa
Description
Authenticates ASDM users who access the security appliance over HTTP. By default, the enable password is used in combination with no username for http access. The aaa command is used to define the TACACS+/RADIUS authentication method. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).
How it is checked
Audit method: Configuration pattern
- Pattern
(?m)^aaa authentication http console \S
How it is fixed
Fix method: Guidance or infrastructure patch
! Configure the aaa authentication for http using the TACACS+ server-group as primary method and the local database as backup method. aaa authentication http console <server-group_name> local
Properties
- Operating systems
- Any
- Tags
- cisco-asanetworkaaa
- Reference
- CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 1.4.3.2 Ensure 'aaa authentication http console' is configured correctly
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target cisco-asa