Ensure "Emergency" account is set

보통레벨 1자동cisco-asa

설명

Sets a local username and password for "Emergency" purposes. This account should only be used for catastrophic failure to the AAA. The password should be kept in a password vault and only accessed in the case of an emergency. After this account is used for the device it is recommended that the password is reset and changed in the password vault. Default device configuration does not require strong user authentication enabling unfettered access to an attacker that can reach the device. Creating a local account with a strong password enforces login authentication and provides a fallback authentication ... CIS marks this Manual; automated: passes when at least one local (emergency) username exists. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).

점검 방법

감사 방식: 구성 패턴

패턴: (?m)^username \S+ (?:password|nopassword|attributes)?

조치 방법

조치 방식: 가이드 또는 인프라 패치

! Run the following to set a local username and password. username <local_username> password <local_password> privilege <level> The privilege level is chosen between 0 and 15. If the privilege is not configured, the default one is 2.

속성

운영 체제: 모두
태그: cisco-asanetworkaaa
참고 자료: CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 1.4.1.2 Ensure "Emergency" account is set

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target cisco-asa