Set username secret for all local users

AltaNivel 1Automatizadacisco-iosxr

Descripción

A root-system user with a normal password will not be authenticated because the normal password is two-way encrypted and poses a security risk because the password information is stored in the flash disk, which can be easily decrypted. Secrets are one-way encrypted and cannot be easily reverted without brute-forcing. Secrets use a one-way cryptographic hash. CIS marks this Manual; automated: fails if any local username has no 'secret'. Audited against the hierarchical output of 'show running-config' (run 'terminal length 0' first; not 'show running-config formal').

Cómo se verifica

Método de auditoría: Patrón de configuración

Patrón: (?m)^username \S+[^\n]*\n(?:[ \t]+(?:$|[^s \t\n]|s(?:$|[^e\n]|e(?:$|[^c\n]|c(?:$|[^r\n]|r(?:$|[^e\n]|e(?:$|[^t\n]|t(?:$|[^ \n])))))))[^\n]*\n)*(?:[^ \t]|\z)

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

configure username {local_username} secret {local_password} commit

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: cisco-iosxrnetworkaaa
Referencia: CIS Cisco IOS XR 7.x Benchmark v1.0.1 - 1.8.2 Set username secret for all local users

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target cisco-iosxr