Ensure 'RSA key pair' is greater than or equal to 2048 bits

보통레벨 2수동 검토cisco-asa

설명

Generates an RSA key pair used by SSH protocol of at least 2048 bits. Secure Shell (SSH) is a secure remote-login protocol. The ASA allows SSH connections to the ASA for management purposes and supports the SSH DES and 3DES ciphers. SSH uses a key-exchange method based on Rivest-Shamir-Adleman (RSA) public-key. Not reliably checkable from an exported configuration. Reported as SKIP with review instructions.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Not reliably checkable from an exported configuration. - Step 1: Run the following to determine whether the RSA key modulus size is equal or greater than 2048 bits. hostname#sh crypto key mypubkey rsa | i _Modulus_Size_.bits.._[2-9][0-9][0-9][0-9] Ths is an example of output where the key pair modulus size is 2048 bits: Asa# sh crypto key mypubkey rsa | i _Modulus_Size_.bits.._[2-9][0-9][0-9][0-9] Modulus Size (bits): 2048 - Step 2: If this output is not displayed, either there is no key configured, either the available modulus size is less than 2048 bits. The system is not compliant.

조치 방법

조치 방식: 가이드 또는 인프라 패치

! - Step 1: Acquire the enterprise standard RSA key size greater or equal than 2048 bits - Step 2: If the audit procedure revealed existing non-compliant key pairs, run the following to remove them: crypto key zeroize rsa - Step 3: Run the following to generate compliant RSA key pair: crypto key generate rsa modulus <enterprise_RSA_key_size> - Step 4: Run the following to save the RSA keys to persistent Flash memory write memory

속성

운영 체제: 모두
태그: cisco-asanetworkhardening
참고 자료: CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 1.6.3 Ensure 'RSA key pair' is greater than or equal to 2048 bits