STIGQter: STIG Summary: HPE Aruba Networking AOS NDM Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 22 Oct 2024:

AOS must be configured to use DOD public key infrastructure (PKI) as multifactor authentication (MFA) for interactive logins.

DISA Rule

SV-266929r1039808_rule

Vulnerability Number

V-266929

Group Title

SRG-APP-000149-NDM-000247

Rule Version

ARBA-ND-000247

Severity

CAT I

CCI(s)

• CCI-000765 - Implement multifactor authentication for network access to privileged accounts.
• CCI-000166 - Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
• CCI-000187 - For public key-based authentication, map the authenticated identity to the account of the individual or group.
• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.

Weight

10

Fix Recommendation

Configure AOS using the web interface:

1. Navigate to Configuration >> System >> Admin and expand "Admin Authentication Servers".
2. Click on the plus sign (+) under "All Servers" and configure the type of authentication server. Provide the Name, Type, and IP address. Click "Submit".
3. Select the created authentication server and configure the required attributes for LDAP:

Admin-dn <username>
Admin-passwd <password>
Re-type admin-passwd <password>
Auth port: 636
Base-dn: cn/ou=<container>,dc=<level>,dc=<mil>
Key-attribute: userPrincipalName

4. Click "Submit."
5. Repeat this process and configure a second authentication server.
6. Click "Pending Changes" and then "Deploy changes".
7. Click on the plus sign (+) under "Server Groups" and add a server group.
8. Click "Submit".
9. Select the created server group and click the plus sign (+) in the Server Group <server group name> box.
10. Add the first configured authentication server.
11. Reselect the created server group and click the plus sign (+) in the Server Group <server group name> box.
12. Click Submit >> Pending Changes >> Deploy Changes.
13. Navigate to Management User.
14. Click on "Show users with certificate authentication". Click on the plus sign (+).
15. Configure each Trusted CA certificate name for any DOD Root CA that provides trust for admin users.
16. Select External server for the Authentication server.
17. Click Submit >> Pending Changes >> Deploy Changes.
18. Expand "Admin Authentication Options". Check "Enable" and "Client certificate". Select the Server group created earlier.
19. Click Submit >> Pending Changes >> Deploy Changes.

Check Contents

Verify the AOS configuration using the web interface:

1. Navigate to Configuration >> System >> Admin and expand "Admin Authentication Options".
2. Verify what "Server group" is handling admin authentication.
3. Verify that Client certificate is enabled.
4. Expand "Admin Authentication Servers".
5. Select the Server Group identified from the "Options" section.
6. Verify that each authentication server configured in Server Group <server group name> is configured with the Key attribute: of userPrincipalName.

If Client certificate is not enabled and the management authentication servers are not configured with userPrincipalName, this is a finding.

Vulnerability Number

V-266929

Documentable

False

Rule Version

ARBA-ND-000247

Severity Override Guidance

Verify the AOS configuration using the web interface:

1. Navigate to Configuration >> System >> Admin and expand "Admin Authentication Options".
2. Verify what "Server group" is handling admin authentication.
3. Verify that Client certificate is enabled.
4. Expand "Admin Authentication Servers".
5. Select the Server Group identified from the "Options" section.
6. Verify that each authentication server configured in Server Group <server group name> is configured with the Key attribute: of userPrincipalName.

If Client certificate is not enabled and the management authentication servers are not configured with userPrincipalName, this is a finding.

Check Content Reference

M

Target Key

5648