STIGQter: STIG Summary: Dell OS10 Switch NDM Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 10 Dec 2024:

The Dell OS10 Switch must implement replay-resistant authentication mechanisms for network access to privileged accounts.

DISA Rule

SV-269780r1051725_rule

Vulnerability Number

V-269780

Group Title

SRG-APP-000156-NDM-000250

Rule Version

OS10-NDM-000390

Severity

CAT II

CCI(s)

• CCI-001941 - Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.

Weight

10

Fix Recommendation

Configure the OS10 Switch to implement replay-resistant authentication mechanisms for network access to privileged accounts:

OS10(config)# crypto fips enable

WARNING: Upon committing this configuration, the system will regenerate SSH keys. Please consult documentation and toggle FIPS mode only if you know what you are doing!
Continue? [yes/no(default)]:yes
OS10(config)#

Disable telnet if it has been enabled:
OS10(config)# no ip telnet server enable

Enable SSH if it has been disabled:
OS10(config)# ip ssh server enable

Check Contents

Review the OS10 Switch configuration to determine if replay-resistant authentication mechanisms are implemented for network access to privileged accounts.

Review the FIPS status to verify that FIPS mode is enabled, as shown below:

OS10# show fips status

FIPS mode: Enabled
Crypto Library: OpenSSL 1.0.2zg-fips 7 Feb 2023
FIPS Object Module: DELL OpenSSL FIPS Crypto Module v2.6 July 2021
OS10#

Verify that SSH is enabled for network access by reviewing the SSH server status:

OS10# show ip ssh | grep "SSH Server:"
SSH Server: Enabled

Verify that telnet is disabled on the switch by verifying that the following is not in the running-configuration:

ip telnet server enable

If FIPS mode is not enabled or if the SSH is not enabled or if telnet is enabled in the OS10 Switch, this is a finding.

Vulnerability Number

V-269780

Documentable

False

Rule Version

OS10-NDM-000390

Severity Override Guidance

Review the OS10 Switch configuration to determine if replay-resistant authentication mechanisms are implemented for network access to privileged accounts.

Review the FIPS status to verify that FIPS mode is enabled, as shown below:

OS10# show fips status

FIPS mode: Enabled
Crypto Library: OpenSSL 1.0.2zg-fips 7 Feb 2023
FIPS Object Module: DELL OpenSSL FIPS Crypto Module v2.6 July 2021
OS10#

Verify that SSH is enabled for network access by reviewing the SSH server status:

OS10# show ip ssh | grep "SSH Server:"
SSH Server: Enabled

Verify that telnet is disabled on the switch by verifying that the following is not in the running-configuration:

ip telnet server enable

If FIPS mode is not enabled or if the SSH is not enabled or if telnet is enabled in the OS10 Switch, this is a finding.

Check Content Reference

M

Target Key

5666