TMAegisBeta
Više pravila za cisco-asa

Cisco ASA

TMA-CISCO-ASA-1.1.5

Ensure 'Password Policy' is enabled

VisokaNivo 1Automatskacisco-asa

Opis

Enforces the Enterprise Password Policy by setting compliant local password requirements for the security appliance. The password policy helps to prevent unauthorized accesses by enforcing the password for more complexity and making them difficult to be guessed. This applies to the local database. Fails unless minimum-length (>= 14), uppercase, lowercase, numeric and special minimums are configured; also fails on lifetime > 365 (or 0) and minimum-changes < 14 when set. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).

Kako se proverava

Metod provere: Obrazac konfiguracije

Obrazac
(?m)(?:\A(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^l\n]|l(?:$|[^e\n]|e(?:$|[^n\n]|n(?:$|[^g\n]|g(?:$|[^t\n]|t(?:$|[^h\n]|h(?:$|[^ \n])))))))))))))))))))))))))))))))[^\n]*\n)*(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^l\n]|l(?:$|[^e\n]|e(?:$|[^n\n]|n(?:$|[^g\n]|g(?:$|[^t\n]|t(?:$|[^h\n]|h(?:$|[^ \n])))))))))))))))))))))))))))))))[^\n]*)?\z)|(?:\A(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^u\n]|u(?:$|[^p\n]|p(?:$|[^p\n]|p(?:$|[^e\n]|e(?:$|[^r\n]|r(?:$|[^c\n]|c(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^e\n]|e(?:$|[^ \n]))))))))))))))))))))))))))))))))))[^\n]*\n)*(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^u\n]|u(?:$|[^p\n]|p(?:$|[^p\n]|p(?:$|[^e\n]|e(?:$|[^r\n]|r(?:$|[^c\n]|c(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^e\n]|e(?:$|[^ \n]))))))))))))))))))))))))))))))))))[^\n]*)?\z)|(?:\A(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^l\n]|l(?:$|[^o\n]|o(?:$|[^w\n]|w(?:$|[^e\n]|e(?:$|[^r\n]|r(?:$|[^c\n]|c(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^e\n]|e(?:$|[^ \n]))))))))))))))))))))))))))))))))))[^\n]*\n)*(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^l\n]|l(?:$|[^o\n]|o(?:$|[^w\n]|w(?:$|[^e\n]|e(?:$|[^r\n]|r(?:$|[^c\n]|c(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^e\n]|e(?:$|[^ \n]))))))))))))))))))))))))))))))))))[^\n]*)?\z)|(?:\A(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^n\n]|n(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^e\n]|e(?:$|[^r\n]|r(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^ \n]))))))))))))))))))))))))))))))))[^\n]*\n)*(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^n\n]|n(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^e\n]|e(?:$|[^r\n]|r(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^ \n]))))))))))))))))))))))))))))))))[^\n]*)?\z)|(?:\A(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^s\n]|s(?:$|[^p\n]|p(?:$|[^e\n]|e(?:$|[^c\n]|c(?:$|[^i\n]|i(?:$|[^a\n]|a(?:$|[^l\n]|l(?:$|[^ \n]))))))))))))))))))))))))))))))))[^\n]*\n)*(?:[ \t]*(?:$|[^p \t\n]|p(?:$|[^a\n]|a(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^w\n]|w(?:$|[^o\n]|o(?:$|[^r\n]|r(?:$|[^d\n]|d(?:$|[^\-\n]|-(?:$|[^p\n]|p(?:$|[^o\n]|o(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^y\n]|y(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^i\n]|i(?:$|[^n\n]|n(?:$|[^i\n]|i(?:$|[^m\n]|m(?:$|[^u\n]|u(?:$|[^m\n]|m(?:$|[^\-\n]|-(?:$|[^s\n]|s(?:$|[^p\n]|p(?:$|[^e\n]|e(?:$|[^c\n]|c(?:$|[^i\n]|i(?:$|[^a\n]|a(?:$|[^l\n]|l(?:$|[^ \n]))))))))))))))))))))))))))))))))[^\n]*)?\z)|(?:^password-policy minimum-length (?:[0-9]|1[0-3])\s*$)|(?:^password-policy lifetime (?:0|36[6-9]|3[7-9]\d|[4-9]\d\d|\d{4,})\s*$)|(?:^password-policy minimum-changes (?:[0-9]|1[0-3])\s*$)|(?:^password-policy minimum-(?:uppercase|lowercase|numeric|special) 0\s*$)

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

! - Step 1: Run the following to set the password lifetime in days to less than or equal to 365 password-policy lifetime 365 - Step 2: Run the following to set the minimum number of characters that must be changed between the old and the new passwords, to be to be greater than or equal to 14 password-policy minimum-changes 14 - Step 3: Run the following to set the minimum number of upper case characters in the password, to be to be greater than or equal to 1 password-policy minimum-uppercase 1 - Step 4: Run the following to set the minimum number of lower case characters in the password, to be to be greater than or equal to 1 password-policy minimum-lowercase 1 - Step 5: Run the following to set the minimum number of numeric characters in the password, to be greater than or equal to 1 password-policy minimum-numeric 1 - Step 6: Run the following to set the minimum number of special characters in the password, to be greater than or equal to 1 password-policy minimum-special 1 - Step 7: Run the following to set the password minimum length, to be greater than or equal to 14 password-policy minimum-length 14

Svojstva

Operativni sistemi
Bilo koji
Oznake
cisco-asanetworkaaa
Referenca
CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 1.1.5 Ensure 'Password Policy' is enabled

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell
tmaegis scan --target cisco-asa