STIGQter: STIG Summary: Dell OS10 Switch NDM Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 10 Dec 2024:

The Dell OS10 Switch must be configured to use DOD PKI as multifactor authentication (MFA) for interactive logins.

DISA Rule

SV-269779r1051722_rule

Vulnerability Number

V-269779

Group Title

SRG-APP-000149-NDM-000247

Rule Version

OS10-NDM-000370

Severity

CAT I

CCI(s)

• CCI-000765 - Implement multifactor authentication for network access to privileged accounts.
• CCI-004046 - Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
• CCI-004047 - Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that the device meets organization-defined strength of mechanism requirements.

Weight

10

Fix Recommendation

Configure the OS10 Switch to use DOD PKI as MFA for interactive logins. Configure a named security profile to use for MFA. Configure the SSH server to enable authentication by PKI certificate:

OS10(config)#
OS10(config)# crypto security-profile <profile-name>
OS10(config-sec-profile)# certificate <host-certificate-name>
OS10(config-sec-profile)# peer-name-check
OS10(config-sec-profile)# ocsp-check <ocsp-url>
OS10(config-sec-profile)# exit
OS10(config)#
OS10(config)# ip ssh server x509v3-authentication security-profile <profile-name>
OS10(config)#

Check Contents

Verify the OS10 Switch is configured to use DOD PKI as MFA for interactive logins. Evidence of successful configuration is usually indicated by a prompt for the user to insert a smartcard. If the smartcard is already inserted, the network device will prompt the user to enter the corresponding PIN which unlocks the certificate keystore on the smartcard.

Review the running-configuration to verify that X.509v3 authentication is enabled for SSH. Verify the PKI authenticated user is mapped to the effective local user account by ensuring that peer-name-check has not been disabled in the associated security profile ("no peer-name-check" is not present).

ip ssh server x509v3-authentication security-profile cacpiv-prof
...
crypto security-profile <profile-name>
certificate <host-certificate-name>
ocsp-check <ocsp-url>
...

If the OS10 Switch is not configured to use DOD PKI as MFA for interactive logins, this is a finding.
If peer-name-check has been disabled in the security profile this is a finding.

Vulnerability Number

V-269779

Documentable

False

Rule Version

OS10-NDM-000370

Severity Override Guidance

Verify the OS10 Switch is configured to use DOD PKI as MFA for interactive logins. Evidence of successful configuration is usually indicated by a prompt for the user to insert a smartcard. If the smartcard is already inserted, the network device will prompt the user to enter the corresponding PIN which unlocks the certificate keystore on the smartcard.

Review the running-configuration to verify that X.509v3 authentication is enabled for SSH. Verify the PKI authenticated user is mapped to the effective local user account by ensuring that peer-name-check has not been disabled in the associated security profile ("no peer-name-check" is not present).

ip ssh server x509v3-authentication security-profile cacpiv-prof
...
crypto security-profile <profile-name>
certificate <host-certificate-name>
ocsp-check <ocsp-url>
...

If the OS10 Switch is not configured to use DOD PKI as MFA for interactive logins, this is a finding.
If peer-name-check has been disabled in the security profile this is a finding.

Check Content Reference

M

Target Key

5666