Configure Password Encryption

高レベル 2自動cisco-nxos

説明

You can enable strong, reversible 128-bit Advanced Encryption Standard (AES) password encryption, also known as type-6 encryption. To start using type-6 encryption, you must enable the AES password encryption feature and configure a master encryption key, which is used to encrypt and decrypt passwords. Encryption is a good way to protect data that will be used later. Encrypted data can later be decrypted to its original value. Although encrypting passwords protects them, typically, an application uses the same encryption key for storing all user passwords. CIS marks this Manual; also confirm a master key is set ('show encryption service stat'). Audited against the output of 'show running-config' (run 'terminal length 0' first; do not use 'show running-config all', which adds default values).

チェック方法

監査方法: 設定パターン

パターン: (?m)^feature password encryption aes\b

修正方法

修正方法: ガイダンスまたは IaC パッチ

! Configure a master key to be used with the AES password encryption feature. The key can contain between 16 and 32 alphanumeric characters key config-key ascii New Master Key: Retype Master Key: feature password encryption aes

プロパティ

オペレーティングシステム: すべて
タグ: cisco-nxosnetworkaaa
参照: CIS Cisco NX-OS Benchmark v1.2.0 - 1.4.2 Configure Password Encryption

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target cisco-nxos --level 2