Set 'modulus' to greater than or equal to 2048 for 'crypto key generate rsa'

СреднийУровень 1Ручная проверкаcisco-iosxr

Описание

Use this command to generate RSA key pairs for your Cisco device. RSA keys are generated in pairs--one public RSA key and one private RSA key. An RSA key pair is a prerequisite for setting up SSH and should be at least 2048 bits. NOTE: IOS does NOT display the modulus bit value in the Audit Procedure. CIS assessment: Manual. Reported as SKIP with review instructions.

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

CIS assessment: Manual. Perform the following to determine if the RSA key pair is configured: IOSXR#sh crypto key mypubkey rsa Wed Jul 19 18:09:46.009 UTC Key label: the_default Type : RSA General purpose Size : 2048 Created : 16:25:09 UTC Wed Jul 19 2023

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

! Generate an RSA key pair for the router. crypto key generate rsa general-keys Wed Jul 19 18:10:51.633 UTC The name for the keys will be: the_default % You already have keys defined for the_default Do you really want to replace them? [yes/no]: yes Choose the size of the key modulus in the range of 512 to 4096 for your General Purpose Keypair. Choosing a key modulus greater than 512 may take a few minutes. How many bits in the modulus [2048]: Generating RSA keys ... Done w/ crypto generate keypair [OK]

Свойства

Операционные системы: Любая
Теги: cisco-iosxrnetworkhardening
Источник: CIS Cisco IOS XR 7.x Benchmark v1.0.1 - 1.2.2 Set 'modulus' to greater than or equal to 2048 for 'crypto key generate rsa'