Set 'access-class' for 'line vty'

TinggiLevel 1Otomatiscisco-ios

Deskripsi

The 'access-class' setting restricts incoming and outgoing connections between a particular vty (into a Cisco device) and the networking devices associated with addresses in an access list. Restricting the type of network devices, associated with the addresses on the access-list, further restricts remote access to those devices authorized to manage the device and reduces the risk of unauthorized access. Fails if any 'line vty' block has no 'access-class <acl> in'. Audited against the output of 'show running-config' (run 'terminal length 0' first; do not use 'show running-config all' or 'show startup-config').

Cara pemeriksaan

Metode audit: Pola konfigurasi

Pola: (?m)^line vty[^\n]*\n(?:[ \t]+(?:$|[^a \t\n]|a(?:$|[^c\n]|c(?:$|[^c\n]|c(?:$|[^e\n]|e(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^\-\n]|-(?:$|[^c\n]|c(?:$|[^l\n]|l(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^ \n])))))))))))))[^\n]*\n)*(?:[^ \t]|\z)

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

! Configure remote management access control restrictions for all VTY lines. line vty <line-number> <ending-line-number> access-class <vty_acl_number> in

Properti

Sistem operasi: Apa saja
Tag: cisco-iosnetworkaaa
Referensi: CIS Cisco IOS XE 17.x Benchmark v2.2.1 - 1.2.5 Set 'access-class' for 'line vty'

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target cisco-ios