Remote Authentication - RADIUS/RadSec/TACACS+

ÉlevéeNiveau 2Automatiséearuba-cx

Description

Remote Authentication involves the use of remote RADIUS , RadSec and TACACS+ servers for authenticating the management users. Remote AAA servers are used as single point of management to configure and store user accounts. They are often coupled with directories and management repositories, simplifying the setup and maintenance of the end-user accounts. PASS requires remote (RADIUS/RadSec/TACACS+) authentication for a management channel. Audited against AOS-CX 'show running-config' output (saved in full); context blocks such as 'password complexity' or 'cli-session' are matched by their indented member lines.

Méthode de vérification

Méthode d'audit: Motif de configuration

Motif: (?m)^aaa authentication login (?:default|console|ssh|telnet|https-server) group \S+

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

aaa authentication login default group tacacs1 local # CIS guidance: Enable remote authentication for desired management interface. Default – Includes all the management interfaces - aaa authentication login <console/default/ssh/telnet/https- <RADIUS/TACACS+ group-list>

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: aruba-cxauthentication
Référence: CIS HPE Aruba Networking CX Switch Benchmark v1.0.1 - 1.5.2.3 Remote Authentication - RADIUS/RadSec/TACACS+

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target aruba-cx --level 2