TMA-F5-BIGIP-2.2
Ensure redundant remote authentication servers are configured
설명
Having multiple points of authentication is important in the event that the primary remote authentication source goes down. PASS requires the system-auth RADIUS configuration to reference at least two servers (primary and secondary). Audited against tmsh output with defaults shown: save the concatenated output of 'tmsh list auth password-policy all-properties', 'tmsh list auth source all-properties', 'tmsh list auth remote-user all-properties', 'tmsh list auth radius all-properties', 'tmsh list sys httpd all-properties', 'tmsh list sys sshd all-properties', 'tmsh list sys global-settings all-properties', 'tmsh list cli global-settings all-properties', 'tmsh list sys ntp', 'tmsh list sys snmp all-properties', 'tmsh list sys syslog' and 'tmsh list net self all-properties'. Patterns are scoped to the named top-level block.
점검 방법
감사 방식: 구성 패턴
- 패턴
(?m)^auth radius (?:/Common/)?system-auth \{\n(?:[ \t]+[^\n]*\n)*?[ \t]+servers \{ \S+ \S+[^\n]*\}[ \t]*$
조치 방법
조치 방식: 가이드 또는 인프라 패치
tmsh create auth radius-server system_auth_name2 server 10.0.0.12 secret <secret> tmsh modify auth radius system-auth servers replace-all-with { system_auth_name1 system_auth_name2 } tmsh save sys config # CIS guidance: 1-Log in to the Configuration utility using the administrator account. 2-Navigate to System > Users > Authentication. 3-In the Authentication section, click Change. 4-Select Remote - RADIUS from the User Directory drop-down menu. 5-Define the RADIUS server configuration settings, including the port and shared secret settings: 6-For "Service Type": select "Authentication Only" 7-This should be completed for Primary RADIUS server as well as for Secondary RADIUS server. 8-Click Finished.
속성
- 운영 체제
- 모두
- 태그
- f5-bigipauthentication
- 참고 자료
- CIS F5 Networks Benchmark v1.0.0 - 2.2 Ensure redundant remote authentication servers are configured
이 호스트 점검하기
감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.
tmaegis scan --target f5-bigip --level 2