Ensure "Emergency" account is set

СреднийУровень 1Автоматическаяcisco-asa

Описание

Sets a local username and password for "Emergency" purposes. This account should only be used for catastrophic failure to the AAA. The password should be kept in a password vault and only accessed in the case of an emergency. After this account is used for the device it is recommended that the password is reset and changed in the password vault. Default device configuration does not require strong user authentication enabling unfettered access to an attacker that can reach the device. Creating a local account with a strong password enforces login authentication and provides a fallback authentication ... CIS marks this Manual; automated: passes when at least one local (emergency) username exists. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).

Как проверяется

Метод проверки: Шаблон конфигурации

Шаблон: (?m)^username \S+ (?:password|nopassword|attributes)?

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

! Run the following to set a local username and password. username <local_username> password <local_password> privilege <level> The privilege level is chosen between 0 and 15. If the privilege is not configured, the default one is 2.

Свойства

Операционные системы: Любая
Теги: cisco-asanetworkaaa
Источник: CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 1.4.1.2 Ensure "Emergency" account is set

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

shell

tmaegis scan --target cisco-asa