Ensure 'OSPF authentication' is enabled

CaoCấp 2Tự độngcisco-asa

Mô tả

Enables the authentication of OSPF neighbor before routing information is received from the neighbor. Enabling the routing protocol authentication prevents against attackers who can send wrong routing information in order to redirect traffic to their network or send malformed packets in order to saturate and to exhaust the control plane. Not applicable (passes) when no 'router ospf' is configured; otherwise fails if no interface has OSPF MD5 authentication. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).

Cách kiểm tra

Phương pháp kiểm tra: Mẫu cấu hình

Mẫu khớp: (?m)\A(?:[ \t]*(?:$|[^o \t\n]|o(?:$|[^s\n]|s(?:$|[^p\n]|p(?:$|[^f\n]|f(?:$|[^ \n]| (?:$|[^am\n]|a(?:$|[^u\n]|u(?:$|[^t\n]|t(?:$|[^h\n]|h(?:$|[^e\n]|e(?:$|[^n\n]|n(?:$|[^t\n]|t(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^a\n]|a(?:$|[^t\n]|t(?:$|[^i\n]|i(?:$|[^o\n]|o(?:$|[^n\n]|n(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^e\n]|e(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^a\n]|a(?:$|[^g\n]|g(?:$|[^e\n]|e(?:$|[^\-\n]|-(?:$|[^d\n]|d(?:$|[^i\n]|i(?:$|[^g\n]|g(?:$|[^e\n]|e(?:$|[^s\n]|s(?:$|[^t\n]))))))))))))))))))))))))))))|m(?:$|[^e\n]|e(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^a\n]|a(?:$|[^g\n]|g(?:$|[^e\n]|e(?:$|[^\-\n]|-(?:$|[^d\n]|d(?:$|[^i\n]|i(?:$|[^g\n]|g(?:$|[^e\n]|e(?:$|[^s\n]|s(?:$|[^t\n]|t(?:$|[^\-\n]|-(?:$|[^k\n]|k(?:$|[^e\n]|e(?:$|[^y\n]|y(?:$|[^ \n]))))))))))))))))))))))))[^\n]*\n)*[ \t]*router ospf [^\n]*(?:\n(?:[ \t]*(?:$|[^o \t\n]|o(?:$|[^s\n]|s(?:$|[^p\n]|p(?:$|[^f\n]|f(?:$|[^ \n]| (?:$|[^am\n]|a(?:$|[^u\n]|u(?:$|[^t\n]|t(?:$|[^h\n]|h(?:$|[^e\n]|e(?:$|[^n\n]|n(?:$|[^t\n]|t(?:$|[^i\n]|i(?:$|[^c\n]|c(?:$|[^a\n]|a(?:$|[^t\n]|t(?:$|[^i\n]|i(?:$|[^o\n]|o(?:$|[^n\n]|n(?:$|[^ \n]| (?:$|[^m\n]|m(?:$|[^e\n]|e(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^a\n]|a(?:$|[^g\n]|g(?:$|[^e\n]|e(?:$|[^\-\n]|-(?:$|[^d\n]|d(?:$|[^i\n]|i(?:$|[^g\n]|g(?:$|[^e\n]|e(?:$|[^s\n]|s(?:$|[^t\n]))))))))))))))))))))))))))))|m(?:$|[^e\n]|e(?:$|[^s\n]|s(?:$|[^s\n]|s(?:$|[^a\n]|a(?:$|[^g\n]|g(?:$|[^e\n]|e(?:$|[^\-\n]|-(?:$|[^d\n]|d(?:$|[^i\n]|i(?:$|[^g\n]|g(?:$|[^e\n]|e(?:$|[^s\n]|s(?:$|[^t\n]|t(?:$|[^\-\n]|-(?:$|[^k\n]|k(?:$|[^e\n]|e(?:$|[^y\n]|y(?:$|[^ \n]))))))))))))))))))))))))[^\n]*))*\n?\z

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

! - Step 1: Acquire the interface <interface_name> used by the firewall to receive OSPF routing updates and the area ID <area_id> - Step 2: Agree with the neighbor device on the authencation key <key_value> and determine an authentication key ID <key_id> - Step 3: Run the following to enable OSPF authentication interface <interface_name> ospf authentication message-digest ospf message-digest-key <key_id> md5 <key_value> exit area <area_id> authentication message-digest

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: cisco-asanetworkaaa
Tham chiếu: CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 2.1.1 Ensure 'OSPF authentication' is enabled

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target cisco-asa --level 2