Enable AES-GCM Encryption of EOS Secrets

높음레벨 1자동arista-eos

설명

AES-GCM has been added as a method for storing symmetric secrets in EOS. This applies to secrets that must be used to remote systems, as found in NTP, TACACS+, and other places. A new secret type "8a", which stands for AES-256-GCM encryption type, has been introduced. Secrets can either be entered in type 0, plaintext, and automatically converted or entered directly as type 8a. The default method of storing shared secrets is to obfuscate them in the running configuration. This obfuscation mean secrets can be easily reversed by copying the configuration out of the box. Audited against the output of 'show running-config' (not 'show running-config all').

점검 방법

감사 방식: 구성 패턴

패턴: (?m)^[ \t]+password encryption reversible aes-256-gcm\b

조치 방법

조치 방식: 가이드 또는 인프라 패치

conf management security password encryption reversible aes-256-gcm

속성

운영 체제: 모두
태그: arista-eosnetworkaaa
참고 자료: CIS Arista EOS Benchmark v1.0.0 - 1.2 Enable AES-GCM Encryption of EOS Secrets

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target arista-eos