Ensure 'Master Key Passphrase' is set

보통레벨 1자동cisco-asa

설명

Defines the master key passphrase used to encrypt the application secret-keys contained in the configuration file for software releases from 8.3(1) and above. For ASA software releases from 8.3 and below, the VPN preshared keys, Tacacs+/Radius shared keys or Routing protocols authentication passwords are encrypted in the running-configuration once generated. 'password encryption aes' is only accepted once a master key passphrase is set. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).

점검 방법

감사 방식: 구성 패턴

패턴: (?m)^password encryption aes\s*$

조치 방법

조치 방식: 가이드 또는 인프라 패치

! - Step 1: Set the master key passphrase with the following command: key config-key password-encryption <passphrase> The passphrase is between 8 and 128 characters long - Step 2: Enable the AES encryption of existing keys of the running-configuration password encryption aes - Step 3: Run the following for the encryption of keys in the startup-configuration write memory

속성

운영 체제: 모두
태그: cisco-asanetworkhardening
참고 자료: CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 1.1.3 Ensure 'Master Key Passphrase' is set

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target cisco-asa