STIGQter: STIG Summary: Dell OS10 Switch NDM Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 10 Dec 2024:

The Dell OS10 Switch must be configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access.

DISA Rule

SV-270643r1052343_rule

Vulnerability Number

V-270643

Group Title

SRG-APP-000516

Rule Version

OS10-NDM-000930

Severity

CAT I

CCI(s)

• CCI-000370 - Manage configuration settings for organization-defined system components using organization-defined automated mechanisms.

Weight

10

Fix Recommendation

Configure the network device to use at least two authentication servers. The authentication order is determined by the order in which the radius-server entries are configured.

OS10(config)#
OS10(config)# radius-server host 10.120.60.23 tls security-profile PROFILE1 key ******************
OS10(config)# radius-server host 10.120.80.82 tls security-profile PROFILE1 key ******************
OS10(config)#
OS10(config)# aaa authentication login default group radius local
OS10(config)# aaa authentication login console group radius local
OS10(config)#

Configure all network connections associated with a device management to use the authentication servers for the purpose of login authentication.
OS10(config)# aaa authentication login default group radius local

Optionally, configure the local console access to try local authentication before attempting remote authentication servers.
OS10(config)# aaa authentication login console local group radius

Check Contents

Review the OS10 switch configuration to verify the device is configured to use at least two authentication servers as primary source for authentication. Verify that multiple radius servers are configured and that AAA login authentication is configured to use remote authentication.

OS10#
OS10# show running-configuration radius-server
radius-server host 10.120.60.23 tls security-profile PROFILE-1 key 9 ****
radius-server host 10.120.80.82 tls security-profile PROFILE1 key 9 ****
OS10#
OS10# show running-configuration aaa
!
aaa authentication login default group radius local
aaa authentication login console local group radius
OS10#

If the OS10 switch is not configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access, this is a finding.

Vulnerability Number

V-270643

Documentable

False

Rule Version

OS10-NDM-000930

Severity Override Guidance

Review the OS10 switch configuration to verify the device is configured to use at least two authentication servers as primary source for authentication. Verify that multiple radius servers are configured and that AAA login authentication is configured to use remote authentication.

OS10#
OS10# show running-configuration radius-server
radius-server host 10.120.60.23 tls security-profile PROFILE-1 key 9 ****
radius-server host 10.120.80.82 tls security-profile PROFILE1 key 9 ****
OS10#
OS10# show running-configuration aaa
!
aaa authentication login default group radius local
aaa authentication login console local group radius
OS10#

If the OS10 switch is not configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access, this is a finding.

Check Content Reference

M

Target Key

5666