TMA-FLASHARRAY-1.5
Ensure SSH key-based authentication is configured for CLI access, preferably sourced from LDAP
설명
FlashArray allows for SSH public keys to be retrieved from a configurable attribute within a configured LDAP server if delegated account management with LDAP is in use. If this is not viable in your environment, or local administrative accounts are in use, then SSH public key based authentication can be configured locally per-user. Manual review in the Purity//FA GUI or CLI (organization-specific or per-object evidence).
점검 방법
감사 방식: 수동 검토
이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.
From the CLI: ; Run the command pureadmin list --publickey to display all users and their public key status. ; Review the output to confirm that all authorized CLI users have a public key configured. ; Test the configuration: Initiate an SSH connection to the array from an administrative workstation using the user's private key to ensure successful authentication.
조치 방법
조치 방식: 가이드 또는 인프라 패치
To align with the security recommendations, configure SSH public keys for your administrative accounts so they can authenticate securely using a private key rather than a password. From the GUI: ; Navigate to Settings > Access > Users and Policies. ; In the Users panel, click the Edit (three vertical dots) icon for the user you want to modify and select Edit User.... ; In the Edit User pop-up window, select Overwrite and paste the user's SSH public key into the Public Key field. ; Click Save. From the CLI: ; Add a public key: Initiate the configuration for a specific user using the pureadmin setattr command. ; Command Syntax: pureadmin setattr --publickey <USERNAME>
속성
- 운영 체제
- 모두
- 태그
- flasharraystorageaccess-control
- 참고 자료
- CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 1.5 Ensure SSH key-based authentication is configured for CLI access, preferably sourced from LDAP