Configure Password Encryption

AltaNivel 2Automatizadacisco-nxos

Descripción

You can enable strong, reversible 128-bit Advanced Encryption Standard (AES) password encryption, also known as type-6 encryption. To start using type-6 encryption, you must enable the AES password encryption feature and configure a master encryption key, which is used to encrypt and decrypt passwords. Encryption is a good way to protect data that will be used later. Encrypted data can later be decrypted to its original value. Although encrypting passwords protects them, typically, an application uses the same encryption key for storing all user passwords. CIS marks this Manual; also confirm a master key is set ('show encryption service stat'). Audited against the output of 'show running-config' (run 'terminal length 0' first; do not use 'show running-config all', which adds default values).

Cómo se verifica

Método de auditoría: Patrón de configuración

Patrón: (?m)^feature password encryption aes\b

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

! Configure a master key to be used with the AES password encryption feature. The key can contain between 16 and 32 alphanumeric characters key config-key ascii New Master Key: Retype Master Key: feature password encryption aes

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: cisco-nxosnetworkaaa
Referencia: CIS Cisco NX-OS Benchmark v1.2.0 - 1.4.2 Configure Password Encryption

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target cisco-nxos --level 2