STIGQter STIGQter: STIG Summary: Cisco IOS XE Router NDM Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 24 Jan 2020: The Cisco router must notify the administrator of changes to access and/or privilege parameters of the administrators account that occurred since the last logon.

DISA Rule

SV-105353r1_rule

Vulnerability Number

V-96215

Group Title

SRG-APP-000079-NDM-000219

Rule Version

CISC-ND-000200

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Step 1: Configure the Cisco router to use an authentication server as shown in the following example:

R4(config)#radius host 10.1.48.2 key xxxxxx

Step 2: Configure the authentication order to use the authentication server as primary source for authentication as shown in the following example:

R4(config)#aaa authentication login LOGIN_AUTHENTICATION group radius local

Step 3: Configure all network connections associated with a device management to use an authentication server for the purpose of login authentication.

R4(config)#line vty 0 4
R4(config-line)#login authentication LOGIN_AUTHENTICATION
R4(config-line)#exit
R4(config)#line con 0
R4(config-line)#login authentication LOGIN_AUTHENTICATION
R4(config-line)#exit
R4(config)#ip http authentication aaa login-authentication LOGIN_AUTHENTICATION

Check Contents

The Cisco router is not compliant with this requirement. However, the risk associated with this requirement can be fully mitigated if the router is configured to utilize an authentication server to authenticate and authorize users for administrative access.

Review the router configuration to verify that the device is configured to use an authentication server as primary source for authentication as shown in the following example:

aaa new-model
!
aaa authentication login LOGIN_AUTHENTICATION group radius local



ip http authentication aaa login-authentication LOGIN_AUTHENTICATION
ip http secure-server



radius-server host x.x.x.x auth-port 1645 acct-port 1646 key xxxxxxx



line con 0
exec-timeout 10 0
login authentication LOGIN_AUTHENTICATION
line vty 0 4
exec-timeout 10 0
login authentication LOGIN_AUTHENTICATION

If the router is not configured to use an authentication server to authenticate and authorize users for administrative access, this is a finding.

Vulnerability Number

V-96215

Documentable

False

Rule Version

CISC-ND-000200

Severity Override Guidance

The Cisco router is not compliant with this requirement. However, the risk associated with this requirement can be fully mitigated if the router is configured to utilize an authentication server to authenticate and authorize users for administrative access.

Review the router configuration to verify that the device is configured to use an authentication server as primary source for authentication as shown in the following example:

aaa new-model
!
aaa authentication login LOGIN_AUTHENTICATION group radius local



ip http authentication aaa login-authentication LOGIN_AUTHENTICATION
ip http secure-server



radius-server host x.x.x.x auth-port 1645 acct-port 1646 key xxxxxxx



line con 0
exec-timeout 10 0
login authentication LOGIN_AUTHENTICATION
line vty 0 4
exec-timeout 10 0
login authentication LOGIN_AUTHENTICATION

If the router is not configured to use an authentication server to authenticate and authorize users for administrative access, this is a finding.

Check Content Reference

M

Target Key

3473

Comments