STIGQter: STIG Summary: RUCKUS ICX NDM Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 27 May 2025:

The RUCKUS ICX device must be configured to assign appropriate user roles or access levels to authenticated users.

DISA Rule

SV-273784r1111052_rule

Vulnerability Number

V-273784

Group Title

SRG-APP-000033-NDM-000212

Rule Version

RCKS-NDM-000100

Severity

CAT I

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

Configure the network device to assign appropriate user roles or access levels to authenticated users.

1. Configure local account:
username [user] privilege [priv_lvl] password [password]

... where priv_lvl equals:
0 – Super User level (full read-write access)
4 – Port Configuration level
5 – Read Only level

2. Configure a RADIUS (or TACACS+) server:
radius-server host x.x.x.x auth-port 1812 acct-port 1813 default key [shared_secret]

3. Configure AAA authentication:
aaa authentication login default radius local
aaa authorization exec default radius

Check Contents

Verify the network device is configured to assign appropriate user roles or access levels to authenticated users.

1. Confirm login authentication is configured for a AAA server followed by local authentication.
SSH@ICX(config)# show running-config | include (aaa.*login|aaa.*exec)
aaa authentication login default radius local
aaa authorization exec default radius

2. Verify local accounts have desired privilege levels.

SSH@ICX# show user
Username Password Encrypt Priv Status Expire Time
======================================================================================================================
local $1$b6Mn/o0q$/HIqAT.num4n80Pyd0um7 enabled 0 enabled Never

If using a AAA for authentication and "aaa authorization exec" line is not present, this is a finding.

If the local user account does not have the correct privilege level assigned, this is a finding.

Vulnerability Number

V-273784

Documentable

False

Rule Version

RCKS-NDM-000100

Severity Override Guidance

Verify the network device is configured to assign appropriate user roles or access levels to authenticated users.

1. Confirm login authentication is configured for a AAA server followed by local authentication.
SSH@ICX(config)# show running-config | include (aaa.*login|aaa.*exec)
aaa authentication login default radius local
aaa authorization exec default radius

2. Verify local accounts have desired privilege levels.

SSH@ICX# show user
Username Password Encrypt Priv Status Expire Time
======================================================================================================================
local $1$b6Mn/o0q$/HIqAT.num4n80Pyd0um7 enabled 0 enabled Never

If using a AAA for authentication and "aaa authorization exec" line is not present, this is a finding.

If the local user account does not have the correct privilege level assigned, this is a finding.

Check Content Reference

M

Target Key

5695