Ensure "Emergency" account is set

中レベル 1自動cisco-asa

説明

Sets a local username and password for "Emergency" purposes. This account should only be used for catastrophic failure to the AAA. The password should be kept in a password vault and only accessed in the case of an emergency. After this account is used for the device it is recommended that the password is reset and changed in the password vault. Default device configuration does not require strong user authentication enabling unfettered access to an attacker that can reach the device. Creating a local account with a strong password enforces login authentication and provides a fallback authentication ... CIS marks this Manual; automated: passes when at least one local (emergency) username exists. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).

チェック方法

監査方法: 設定パターン

パターン: (?m)^username \S+ (?:password|nopassword|attributes)?

修正方法

修正方法: ガイダンスまたは IaC パッチ

! Run the following to set a local username and password. username <local_username> password <local_password> privilege <level> The privilege level is chosen between 0 and 15. If the privilege is not configured, the default one is 2.

プロパティ

オペレーティングシステム: すべて
タグ: cisco-asanetworkaaa
参照: CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 1.4.1.2 Ensure "Emergency" account is set

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target cisco-asa