Ensure "Emergency" account is set

SedangLevel 1Otomatiscisco-asa

Deskripsi

Sets a local username and password for "Emergency" purposes. This account should only be used for catastrophic failure to the AAA. The password should be kept in a password vault and only accessed in the case of an emergency. After this account is used for the device it is recommended that the password is reset and changed in the password vault. Default device configuration does not require strong user authentication enabling unfettered access to an attacker that can reach the device. Creating a local account with a strong password enforces login authentication and provides a fallback authentication ... CIS marks this Manual; automated: passes when at least one local (emergency) username exists. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).

Cara pemeriksaan

Metode audit: Pola konfigurasi

Pola: (?m)^username \S+ (?:password|nopassword|attributes)?

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

! Run the following to set a local username and password. username <local_username> password <local_password> privilege <level> The privilege level is chosen between 0 and 15. If the privilege is not configured, the default one is 2.

Properti

Sistem operasi: Apa saja
Tag: cisco-asanetworkaaa
Referensi: CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 1.4.1.2 Ensure "Emergency" account is set

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target cisco-asa