TMA-CISCO-IOSXR-1.8.2
Set username secret for all local users
Opis
A root-system user with a normal password will not be authenticated because the normal password is two-way encrypted and poses a security risk because the password information is stored in the flash disk, which can be easily decrypted. Secrets are one-way encrypted and cannot be easily reverted without brute-forcing. Secrets use a one-way cryptographic hash. CIS marks this Manual; automated: fails if any local username has no 'secret'. Audited against the hierarchical output of 'show running-config' (run 'terminal length 0' first; not 'show running-config formal').
Kako se proverava
Metod provere: Obrazac konfiguracije
- Obrazac
(?m)^username \S+[^\n]*\n(?:[ \t]+(?:$|[^s \t\n]|s(?:$|[^e\n]|e(?:$|[^c\n]|c(?:$|[^r\n]|r(?:$|[^e\n]|e(?:$|[^t\n]|t(?:$|[^ \n])))))))[^\n]*\n)*(?:[^ \t]|\z)
Kako se ispravlja
Metod ispravke: Smernica ili zakrpa infrastrukture
configure username {local_username} secret {local_password} commit
Svojstva
- Operativni sistemi
- Bilo koji
- Oznake
- cisco-iosxrnetworkaaa
- Referenca
- CIS Cisco IOS XR 7.x Benchmark v1.0.1 - 1.8.2 Set username secret for all local users
Proverite ovaj računar
Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.
tmaegis scan --target cisco-iosxr