STIGQter: STIG Summary: HPE Aruba Networking AOS NDM Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 22 Oct 2024:

AOS must transmit only encrypted representations of passwords.

DISA Rule

SV-266937r1039832_rule

Vulnerability Number

V-266937

Group Title

SRG-APP-000172-NDM-000259

Rule Version

ARBA-ND-000259

Severity

CAT I

CCI(s)

• CCI-000197 - For password-based authentication, transmit passwords only cryptographically-protected channels.

Weight

10

Fix Recommendation

Configure AOS with the following commands:
configure terminal
aaa authentication-server ldap <server name>
authport 636
preferred-conn-type ldap-s
exit
snmp-server user <username> auth-prot sha <passphrase> priv-prot AES <passphrase>
write memory

Check Contents

Verify the AOS configuration with the following commands:
show aaa authentication-server all
show snmp user-table

If the LDAP servers are not configured to use port 636, or if the SNMP users are not configured to use AES encryption, this is a finding.

Vulnerability Number

V-266937

Documentable

False

Rule Version

ARBA-ND-000259

Severity Override Guidance

Verify the AOS configuration with the following commands:
show aaa authentication-server all
show snmp user-table

If the LDAP servers are not configured to use port 636, or if the SNMP users are not configured to use AES encryption, this is a finding.

Check Content Reference

M

Target Key

5648