STIGQter: STIG Summary: Arista MLS EOS 4.X NDM Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 02 Apr 2025:

If the Arista network device uses role-based access control, the network device must enforce organization-defined role-based access control policies over defined subjects and objects.

DISA Rule

SV-255957r987662_rule

Vulnerability Number

V-255957

Group Title

SRG-APP-000329-NDM-000287

Rule Version

ARST-ND-000550

Severity

CAT II

CCI(s)

• CCI-001813 - Enforce access restrictions using organization-defined mechanisms.
• CCI-002169 - Enforce a role-based access control policy over defined subjects and objects based upon organization-defined roles and users authorized to assume such roles.

Weight

10

Fix Recommendation

Configure the network device and its associated authentication server to enforce role-based access control policy over defined subjects and objects.

switch(config)#
role network-admin
10 permit command .*
!
role operator
10 permit command show running-config [all|detail] sanitized
20 deny command >|>>|extension|\||session|do|delete|copy|rmdir|mkdir|python-shell|bash|platform|scp|append|redirect|tee|more|less|who|show run.*
30 deny mode config command (no |default )?(username|role|aaa|tcpdump|schedule|event.*)
40 permit command .*
!
role tester
10 permit command show running-config [all|detail] sanitized
20 deny command >|>>|extension|\||session|do|delete|copy|rmdir|mkdir|python-shell|bash|platform|scp|append|redirect|tee|more|less|who|show run.*
30 deny mode config command (no |default )(username|role|aaa|tcpdump|schedule|event.*)
40 permit command .*

Check Contents

Determine if the network device enforces role-based access control policy over defined subjects and objects. This requirement may be met through use of a properly configured authentication server.

Note: If not using role-based access for the network device, this check is Not Applicable.

Step 2: Verify the Arista network device configured AAA servers are synchronized for all role-based authentication access control structure defined by role types and user-defined control policies over defined subjects and objects.

switch(config)#show running-config | section role

role network-admin
10 permit command .*
!
role operator
10 permit command show running-config [all|detail] sanitized
20 deny command >|>>|extension|\||session|do|delete|copy|rmdir|mkdir|python-shell|bash|platform|scp|append|redirect|tee|more|less|who|show run.*
30 deny mode config command (no |default )?(username|role|aaa|tcpdump|schedule|event.*)
40 permit command .*
!
role tester
10 permit command show running-config [all|detail] sanitized
20 deny command >|>>|extension|\||session|do|delete|copy|rmdir|mkdir|python-shell|bash|platform|scp|append|redirect|tee|more|less|who|show run.*
30 deny mode config command (no |default )(username|role|aaa|tcpdump|schedule|event.*)
40 permit command .*

If role-based access control policy is not enforced over defined subjects and objects, this is a finding.

Vulnerability Number

V-255957

Documentable

False

Rule Version

ARST-ND-000550

Severity Override Guidance

Determine if the network device enforces role-based access control policy over defined subjects and objects. This requirement may be met through use of a properly configured authentication server.

Note: If not using role-based access for the network device, this check is Not Applicable.

Step 2: Verify the Arista network device configured AAA servers are synchronized for all role-based authentication access control structure defined by role types and user-defined control policies over defined subjects and objects.

switch(config)#show running-config | section role

role network-admin
10 permit command .*
!
role operator
10 permit command show running-config [all|detail] sanitized
20 deny command >|>>|extension|\||session|do|delete|copy|rmdir|mkdir|python-shell|bash|platform|scp|append|redirect|tee|more|less|who|show run.*
30 deny mode config command (no |default )?(username|role|aaa|tcpdump|schedule|event.*)
40 permit command .*
!
role tester
10 permit command show running-config [all|detail] sanitized
20 deny command >|>>|extension|\||session|do|delete|copy|rmdir|mkdir|python-shell|bash|platform|scp|append|redirect|tee|more|less|who|show run.*
30 deny mode config command (no |default )(username|role|aaa|tcpdump|schedule|event.*)
40 permit command .*

If role-based access control policy is not enforced over defined subjects and objects, this is a finding.

Check Content Reference

M

Target Key

5511