Set 'access-class' for 'line vty'

AltaNivel 1Automatizadacisco-ios

Descripción

The 'access-class' setting restricts incoming and outgoing connections between a particular vty (into a Cisco device) and the networking devices associated with addresses in an access list. Restricting the type of network devices, associated with the addresses on the access-list, further restricts remote access to those devices authorized to manage the device and reduces the risk of unauthorized access. Fails if any 'line vty' block has no 'access-class <acl> in'. Audited against the output of 'show running-config' (run 'terminal length 0' first; do not use 'show running-config all' or 'show startup-config').

Cómo se verifica

Método de auditoría: Patrón de configuración

Patrón: (?m)^line vty[^\n]*\n(?:[ \t]+(?:$|[^a \t\n]|a(?:$|[^c\n]|c(?:$|[^c\n]|c(?:$|[^e\n]|e(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^\-\n]|-(?:$|[^c\n]|c(?:$|[^l\n]|l(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^ \n])))))))))))))[^\n]*\n)*(?:[^ \t]|\z)

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

! Configure remote management access control restrictions for all VTY lines. line vty <line-number> <ending-line-number> access-class <vty_acl_number> in

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: cisco-iosnetworkaaa
Referencia: CIS Cisco IOS XE 17.x Benchmark v2.2.1 - 1.2.5 Set 'access-class' for 'line vty'

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target cisco-ios