TMA-CISCO-IOSXR-1.1.1.2

RADIUS (AAA server group)

VisokaNivo 2Automatskacisco-iosxr

Opis

Cisco IOS XR devices can use the RADIUS protocol to communicate with a central AAA server. Using a central authentication store ensures that all administrative actions are tied to named users, making the tracking of changes much easier. It also makes tracking compromised accounts and malicious activities much easier. Central authentication is key as it minimizes the effort in managing named user accounts. Keeping local admin accounts opens the door to all the issues inherent in shared accounts, namely: - Errors in implementation being done by generic admin accounts, which ... Passes with two or more 'radius-server host' entries referenced by an 'aaa group server radius', or when TACACS+ (and no RADIUS) is used instead. Audited against the hierarchical output of 'show running-config' (run 'terminal length 0' first; not 'show running-config formal').

Kako se proverava

Metod provere: Obrazac konfiguracije

Obrazac: (?m)(?:(?s:^radius-server host \S.*^radius-server host \S.*^aaa group server radius \S))|(?:\A(?:[ \t]*(?:$|[^r \t\n]|r(?:$|[^a\n]|a(?:$|[^d\n]|d(?:$|[^i\n]|i(?:$|[^u\n]|u(?:$|[^s\n]|s(?:$|[^\-\n]|-(?:$|[^s\n]|s(?:$|[^e\n]|e(?:$|[^r\n]|r(?:$|[^v\n]|v(?:$|[^e\n]|e(?:$|[^r\n]|r(?:$|[^ \n]| (?:$|[^h\n]|h(?:$|[^o\n]|o(?:$|[^s\n]|s(?:$|[^t\n]|t(?:$|[^ \n])))))))))))))))))))[^\n]*\n)*[ \t]*tacacs-server host [^\n]*(?:\n(?:[ \t]*(?:$|[^r \t\n]|r(?:$|[^a\n]|a(?:$|[^d\n]|d(?:$|[^i\n]|i(?:$|[^u\n]|u(?:$|[^s\n]|s(?:$|[^\-\n]|-(?:$|[^s\n]|s(?:$|[^e\n]|e(?:$|[^r\n]|r(?:$|[^v\n]|v(?:$|[^e\n]|e(?:$|[^r\n]|r(?:$|[^ \n]| (?:$|[^h\n]|h(?:$|[^o\n]|o(?:$|[^s\n]|s(?:$|[^t\n]|t(?:$|[^ \n])))))))))))))))))))[^\n]*))*\n?\z)

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

For complete instructions how to configure AAA please refer to the configuration guide. Below you can find some minimum config snippets to implement a radius or tacacs+ server group. radius-server host {radius_ip_address} key {radius_key} aaa group server radius {radius_group_name} server radius_ip_address}

Svojstva

Operativni sistemi: Bilo koji
Oznake: cisco-iosxrnetworkaaa
Referenca: CIS Cisco IOS XR 7.x Benchmark v1.0.1 - 1.1.1.2 RADIUS

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target cisco-iosxr --level 2