STIGQter: STIG Summary: Dell OS10 Switch NDM Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 10 Dec 2024:

The Dell OS10 Switch, for PKI-based authentication, must be configured to map validated certificates to unique user accounts.

DISA Rule

SV-269787r1052488_rule

Vulnerability Number

V-269787

Group Title

SRG-APP-000177-NDM-000263

Rule Version

OS10-NDM-000490

Severity

CAT I

CCI(s)

• CCI-000187 - For public key-based authentication, map the authenticated identity to the account of the individual or group.
• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
• CCI-000166 - Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.

Weight

10

Fix Recommendation

Configure the OS10 Switch to use DOD PKI as MFA for interactive logins. Configure a named security profile to use for MFA. Configure the SSH server to enable authentication by PKI certificate.

OS10(config)#
OS10(config)# crypto security-profile <profile-name>
OS10(config-sec-profile)# certificate <host-certificate-name>
OS10(config-sec-profile)# peer-name-check
OS10(config-sec-profile)# ocsp-check <ocsp-url>
OS10(config-sec-profile)# exit
OS10(config)#
OS10(config)# ip ssh server x509v3-authentication security-profile <profile-name>
OS10(config)#

Check Contents

If PKI-based authentication is not used as the MFA solution for interactive logins, this requirement is not applicable.

OS10 maps certificates to valid usernames by comparing the common name and user principal name in the certificate to the unique user account name. This check is applied by default unless name checking has been disabled in the security profile with the "no peer-name-check" setting.

Review the running-configuration to verify that X.509v3 authentication is enabled for SSH. Verify the PKI authenticated user is mapped to the effective local user account by ensuring that peer-name-check has not been disabled in the associated security profile ("no peer-name-check" is not present).

ip ssh server x509v3-authentication security-profile cacpiv-prof
...
crypto security-profile <profile-name>
certificate <host-certificate-name>
ocsp-check <ocsp-url>
...

If peer-name-check has been disabled in the security profile this is a finding.

Vulnerability Number

V-269787

Documentable

False

Rule Version

OS10-NDM-000490

Severity Override Guidance

If PKI-based authentication is not used as the MFA solution for interactive logins, this requirement is not applicable.

OS10 maps certificates to valid usernames by comparing the common name and user principal name in the certificate to the unique user account name. This check is applied by default unless name checking has been disabled in the security profile with the "no peer-name-check" setting.

Review the running-configuration to verify that X.509v3 authentication is enabled for SSH. Verify the PKI authenticated user is mapped to the effective local user account by ensuring that peer-name-check has not been disabled in the associated security profile ("no peer-name-check" is not present).

ip ssh server x509v3-authentication security-profile cacpiv-prof
...
crypto security-profile <profile-name>
certificate <host-certificate-name>
ocsp-check <ocsp-url>
...

If peer-name-check has been disabled in the security profile this is a finding.

Check Content Reference

M

Target Key

5666