Ensure 'RSA key pair' is greater than or equal to 2048 bits

MediaNivel 2Revisión manualcisco-asa

Descripción

Generates an RSA key pair used by SSH protocol of at least 2048 bits. Secure Shell (SSH) is a secure remote-login protocol. The ASA allows SSH connections to the ASA for management purposes and supports the SSH DES and 3DES ciphers. SSH uses a key-exchange method based on Rivest-Shamir-Adleman (RSA) public-key. Not reliably checkable from an exported configuration. Reported as SKIP with review instructions.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Not reliably checkable from an exported configuration. - Step 1: Run the following to determine whether the RSA key modulus size is equal or greater than 2048 bits. hostname#sh crypto key mypubkey rsa | i _Modulus_Size_.bits.._[2-9][0-9][0-9][0-9] Ths is an example of output where the key pair modulus size is 2048 bits: Asa# sh crypto key mypubkey rsa | i _Modulus_Size_.bits.._[2-9][0-9][0-9][0-9] Modulus Size (bits): 2048 - Step 2: If this output is not displayed, either there is no key configured, either the available modulus size is less than 2048 bits. The system is not compliant.

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

! - Step 1: Acquire the enterprise standard RSA key size greater or equal than 2048 bits - Step 2: If the audit procedure revealed existing non-compliant key pairs, run the following to remove them: crypto key zeroize rsa - Step 3: Run the following to generate compliant RSA key pair: crypto key generate rsa modulus <enterprise_RSA_key_size> - Step 4: Run the following to save the RSA keys to persistent Flash memory write memory

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: cisco-asanetworkhardening
Referencia: CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 1.6.3 Ensure 'RSA key pair' is greater than or equal to 2048 bits