STIGQter: STIG Summary: Arista MLS EOS 4.X NDM Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

The Arista network device must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable.

DISA Rule

SV-255953r1051115_rule

Vulnerability Number

V-255953

Group Title

SRG-APP-000148-NDM-000346

Rule Version

ARST-ND-000350

Severity

CAT II

CCI(s)

• CCI-001358 - Establish privileged user accounts in accordance with a role-based access scheme; or an attribute-based access scheme.

Weight

10

Fix Recommendation

Step 1: Configure the Arista network device for a username "Emergency-Admin" account of last resort using the following command:

switch#configure
switch(config)#username Emergency-Admin privilege 15 role network-admin secret 0 <plain-text password>

Step 2: Ensure the Arista network device default account has been overwritten with the local account of last resort.

switch#sh running-config | section username
username Emergency-Admin privilege 15 role network-admin secret sha512 $6$ObuWg.Eu7DwGD8k/$EgT0uI.hLrStrmxUvJijecxDXr.Zy.imi1UrDzDP38q8Erqgkfe0IhHzIhYmR3ekW74XdAFf7I6SgzAoUFd0
!

Use the following command to remove the default admin account if necessary:

switch(config)#no username admin

Step 3: As a final step in the case all administrative accounts are locked out of the device, ensure the username and password created for the account of last resort is contained within a sealed envelope and kept in a safe or secure network location.

Check Contents

Step 1: Verify on the Arista network device that an account of last resort is configured using the following command:

switch#sh running-config | section username
username Emergency-Admin privilege 15 role network-admin secret sha512 $6$ObuWg.Eu7DwGD8k/$EgT0uI.hLrStrmxUvJijecxDXr.Zy.imi1UrDzDP38q8Erqgkfe0IhHzIhYmR3ekW74XdAFf7I6SgzAoUFd0

Step 2: Verify the Arista network device default account has been overwritten with the local account of last resort.

switch#sh running-config | section username
username Emergency-Admin privilege 15 role network-admin secret sha512 $6$ObuWg.Eu7DwGD8k/$EgT0uI.hLrStrmxUvJijecxDXr.Zy.imi1UrDzDP38q8Erqgkfe0IhHzIhYmR3ekW74XdAFf7I6SgzAoUFd0

If one local account on the Arista network device does not exist for use as the account of last resort in the event the authentication server is unavailable, this is a finding.

If the default admin account exists on the device, this is a finding.

Vulnerability Number

V-255953

Documentable

False

Rule Version

ARST-ND-000350

Severity Override Guidance

Step 1: Verify on the Arista network device that an account of last resort is configured using the following command:

switch#sh running-config | section username
username Emergency-Admin privilege 15 role network-admin secret sha512 $6$ObuWg.Eu7DwGD8k/$EgT0uI.hLrStrmxUvJijecxDXr.Zy.imi1UrDzDP38q8Erqgkfe0IhHzIhYmR3ekW74XdAFf7I6SgzAoUFd0

Step 2: Verify the Arista network device default account has been overwritten with the local account of last resort.

switch#sh running-config | section username
username Emergency-Admin privilege 15 role network-admin secret sha512 $6$ObuWg.Eu7DwGD8k/$EgT0uI.hLrStrmxUvJijecxDXr.Zy.imi1UrDzDP38q8Erqgkfe0IhHzIhYmR3ekW74XdAFf7I6SgzAoUFd0

If one local account on the Arista network device does not exist for use as the account of last resort in the event the authentication server is unavailable, this is a finding.

If the default admin account exists on the device, this is a finding.

Check Content Reference

M

Target Key

5511