Cisco ASA
TMA-CISCO-ASA-1.1.5
Ensure 'Password Policy' is enabled
Opis
Enforces the Enterprise Password Policy by setting compliant local password requirements for the security appliance. The password policy helps to prevent unauthorized accesses by enforcing the password for more complexity and making them difficult to be guessed. This applies to the local database. Fails unless minimum-length (>= 14), uppercase, lowercase, numeric and special minimums are configured; also fails on lifetime > 365 (or 0) and minimum-changes < 14 when set. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).
Kako se proverava
Metod provere: Obrazac konfiguracije
- Obrazac
(?m)(?:\A(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^l\n]|l(?:$|[^e\n]|e(?:$|[^n\n]|n(?:$|[^g\n]|g(?:$|[^t\n]|t(?:$|[^h\n]|h(?:$|[^ \n])))))))))))))))))))))))))))))))[^\n]*\n)*(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^l\n]|l(?:$|[^e\n]|e(?:$|[^n\n]|n(?:$|[^g\n]|g(?:$|[^t\n]|t(?:$|[^h\n]|h(?:$|[^ \n])))))))))))))))))))))))))))))))[^\n]*)?\z)|(?:\A(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^u\n]|u(?:$|[^p\n]|p(?:$|[^p\n]|p(?:$|[^e\n]|e(?:$|[^r\n]|r(?:$|[^c\n]|c(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^e\n]|e(?:$|[^ \n]))))))))))))))))))))))))))))))))))[^\n]*\n)*(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^u\n]|u(?:$|[^p\n]|p(?:$|[^p\n]|p(?:$|[^e\n]|e(?:$|[^r\n]|r(?:$|[^c\n]|c(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^e\n]|e(?:$|[^ \n]))))))))))))))))))))))))))))))))))[^\n]*)?\z)|(?:\A(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^l\n]|l(?:$|[^o\n]|o(?:$|[^w\n]|w(?:$|[^e\n]|e(?:$|[^r\n]|r(?:$|[^c\n]|c(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^e\n]|e(?:$|[^ \n]))))))))))))))))))))))))))))))))))[^\n]*\n)*(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^l\n]|l(?:$|[^o\n]|o(?:$|[^w\n]|w(?:$|[^e\n]|e(?:$|[^r\n]|r(?:$|[^c\n]|c(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^e\n]|e(?:$|[^ \n]))))))))))))))))))))))))))))))))))[^\n]*)?\z)|(?:\A(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^n\n]|n(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^e\n]|e(?:$|[^r\n]|r(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^ \n]))))))))))))))))))))))))))))))))[^\n]*\n)*(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^n\n]|n(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^e\n]|e(?:$|[^r\n]|r(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^ \n]))))))))))))))))))))))))))))))))[^\n]*)?\z)|(?:\A(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^s\n]|s(?:$|[^p\n]|p(?:$|[^e\n]|e(?:$|[^c\n]|c(?:$|[^i\n]|i(?:$|[^a\n]|a(?:$|[^l\n]|l(?:$|[^ \n]))))))))))))))))))))))))))))))))[^\n]*\n)*(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^s\n]|s(?:$|[^p\n]|p(?:$|[^e\n]|e(?:$|[^c\n]|c(?:$|[^i\n]|i(?:$|[^a\n]|a(?:$|[^l\n]|l(?:$|[^ \n]))))))))))))))))))))))))))))))))[^\n]*)?\z)|(?:^password-policy minimum-length (?:[0-9]|1[0-3])\s*$)|(?:^password-policy lifetime (?:0|36[6-9]|3[7-9]\d|[4-9]\d\d|\d{4,})\s*$)|(?:^password-policy minimum-changes (?:[0-9]|1[0-3])\s*$)|(?:^password-policy minimum-(?:uppercase|lowercase|numeric|special) 0\s*$)
Kako se ispravlja
Metod ispravke: Smernica ili zakrpa infrastrukture
! - Step 1: Run the following to set the password lifetime in days to less than or equal to 365 password-policy lifetime 365 - Step 2: Run the following to set the minimum number of characters that must be changed between the old and the new passwords, to be to be greater than or equal to 14 password-policy minimum-changes 14 - Step 3: Run the following to set the minimum number of upper case characters in the password, to be to be greater than or equal to 1 password-policy minimum-uppercase 1 - Step 4: Run the following to set the minimum number of lower case characters in the password, to be to be greater than or equal to 1 password-policy minimum-lowercase 1 - Step 5: Run the following to set the minimum number of numeric characters in the password, to be greater than or equal to 1 password-policy minimum-numeric 1 - Step 6: Run the following to set the minimum number of special characters in the password, to be greater than or equal to 1 password-policy minimum-special 1 - Step 7: Run the following to set the password minimum length, to be greater than or equal to 14 password-policy minimum-length 14
Svojstva
- Operativni sistemi
- Bilo koji
- Oznake
- cisco-asanetworkaaa
- Referenca
- CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 1.1.5 Ensure 'Password Policy' is enabled
Proverite ovaj računar
Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.
tmaegis scan --target cisco-asa