Arista EOS
TMA-ARISTA-EOS-1.2
Enable AES-GCM Encryption of EOS Secrets
Descripción
AES-GCM has been added as a method for storing symmetric secrets in EOS. This applies to secrets that must be used to remote systems, as found in NTP, TACACS+, and other places. A new secret type "8a", which stands for AES-256-GCM encryption type, has been introduced. Secrets can either be entered in type 0, plaintext, and automatically converted or entered directly as type 8a. The default method of storing shared secrets is to obfuscate them in the running configuration. This obfuscation mean secrets can be easily reversed by copying the configuration out of the box. Audited against the output of 'show running-config' (not 'show running-config all').
Cómo se verifica
Método de auditoría: Patrón de configuración
- Patrón
(?m)^[ \t]+password encryption reversible aes-256-gcm\b
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
conf management security password encryption reversible aes-256-gcm
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- arista-eosnetworkaaa
- Referencia
- CIS Arista EOS Benchmark v1.0.0 - 1.2 Enable AES-GCM Encryption of EOS Secrets
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
tmaegis scan --target arista-eos