TMA-CISCO-ASA-1.4.5.3
Ensure 'aaa accounting for EXEC mode' is configured correctly
HighLevel 1Automatedcisco-asa
Description
Enables accounting of administrative access by specifying the start and stop of EXEC sessions. The AAA accounting feature enables to track the actions performed by users and to store the data collected into AAA serves for further audit or further analysis. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).
How it is checked
Audit method: Configuration pattern
- Pattern
(?m)^aaa accounting enable console \S
How it is fixed
Fix method: Guidance or infrastructure patch
! Run the following in order to record exec mode session start and stop and to send them to the AAA servers aaa accounting enable console <server-group_name>
Properties
- Operating systems
- Any
- Tags
- cisco-asanetworklogging
- Reference
- CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 1.4.5.3 Ensure 'aaa accounting for EXEC mode' is configured correctly
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target cisco-asa