Set 'login authentication for 'ip http'

높음레벨 1자동cisco-ios

설명

If account management functions are not automatically enforced, an attacker could gain privileged access to a vital element of the network security architecture. Configure the device to enforce authentication for the HTTP server (ip http) by defining a valid login method. This ensures that only authorized users can access the device's web-based management interface. Fails only when the HTTP or HTTPS server is enabled and no 'ip http authentication' line exists; passes when both servers are disabled. Audited against the output of 'show running-config' (run 'terminal length 0' first; do not use 'show running-config all' or 'show startup-config').

점검 방법

감사 방식: 구성 패턴

패턴: (?m)\A(?:[ \t]*(?:$|[^i \t\n]|i(?:$|[^p\n]|p(?:$|[^ \n]| (?:$|[^h\n]|h(?:$|[^t\n]|t(?:$|[^t\n]|t(?:$|[^p\n]|p(?:$|[^ \n]| (?:$|[^a\n]|a(?:$|[^u\n]|u(?:$|[^t\n]|t(?:$|[^h\n]|h(?:$|[^e\n]|e(?:$|[^n\n]|n(?:$|[^t\n]|t(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^a\n]|a(?:$|[^t\n]|t(?:$|[^i\n]|i(?:$|[^o\n]|o(?:$|[^n\n]|n(?:$|[^ \n])))))))))))))))))))))))[^\n]*\n)*ip http (?:secure-)?server[ \t\r]*(?:\n(?:[ \t]*(?:$|[^i \t\n]|i(?:$|[^p\n]|p(?:$|[^ \n]| (?:$|[^h\n]|h(?:$|[^t\n]|t(?:$|[^t\n]|t(?:$|[^p\n]|p(?:$|[^ \n]| (?:$|[^a\n]|a(?:$|[^u\n]|u(?:$|[^t\n]|t(?:$|[^h\n]|h(?:$|[^e\n]|e(?:$|[^n\n]|n(?:$|[^t\n]|t(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^a\n]|a(?:$|[^t\n]|t(?:$|[^i\n]|i(?:$|[^o\n]|o(?:$|[^n\n]|n(?:$|[^ \n])))))))))))))))))))))))[^\n]*))*\n?\z

조치 방법

조치 방식: 가이드 또는 인프라 패치

! Configure management lines to require login using the default or a named AAA authentication list. This configuration must be set individually for all line types. ip http secure-server ip http authentication {default | _aaa_list_name_}

속성

운영 체제: 모두
태그: cisco-iosnetworklogging
참고 자료: CIS Cisco IOS XE 17.x Benchmark v2.2.1 - 1.1.5 Set 'login authentication for 'ip http'

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target cisco-ios