STIGQter: STIG Summary: HPE Alletra Storage ArcusOS Network Device Management Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Feb 2026:

The HPE Alletra Storage ArcusOS device must be configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access.

DISA Rule

SV-283425r1194969_rule

Vulnerability Number

V-283425

Group Title

SRG-APP-000516-NDM-000336

Rule Version

ASMP-ND-001060

Severity

CAT I

CCI(s)

• CCI-000370 - Manage configuration settings for organization-defined system components using organization-defined automated mechanisms.
• CCI-001941 - Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.
• CCI-000187 - For public key-based authentication, map the authenticated identity to the account of the individual or group.
• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
• CCI-000166 - Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.

Weight

10

Fix Recommendation

Use the following commands to configure the primary and secondary authentication servers.

cli% setauthparam -f ldap-type <type> where type is MSAD, RHDS or OPEN.
cli% setauthparam ldap-server <primary hostname> <secondary hostname>
cli% setauthparam -f accounts-dn <base of the ad subtree, such as CN=Users,DC=win2k12forest,DC=thisdomain,DC=com>
cli% setauthparam -f kerberos-realm <Kerberos-realm configuration>
cli% setauthparam -f ldap-reqcert 1

Set up a super role such as the super role:
cli% setauthparam -f super-map <customer-assigned name of "super" group>

Enable TLS with:
cli% setauthparam -f ldap-StartTLS require
or
cli% setauthparam -f ldap-ssl 1

Import a TLS certificate:
cli% importcert ldap -f stdin

Check Contents

Determine if the system is configured to use a primary and secondary authentication server with the following command:

cli% showauthparam
ldap-type MSAD
accounts-dn <accounts dn configuration>
super-map <super-map configuration>
edit-map <edit-map configuration>
browse-map <browse-map configuration>
service-map <service-map configuration>
ldap-StartTLS require
kerberos-realm <Kerberos-realm configuration>
ldap-2FA-cert-field subjectAlt:rfc822Name
ldap-2FA-object-attr mail
ldap-server <server hostname>
ldap-server <server hostname>
ldap-ssl-cacert:
-----BEGIN CERTIFICATE-----

If the command output does not list authparams for ldap-type, kerberos-realm, accounts-dn, ldap-ssl-cacert, and at least one role map (e.g., super-map), this is a finding.

If there are not two ldap-server lines, this is a finding.

ldap-StartTLS must be set to require, if not, this is a finding.

If the ldap-reqcert authparam is not set to "1", this is a finding.

Vulnerability Number

V-283425

Documentable

False

Rule Version

ASMP-ND-001060

Severity Override Guidance

Determine if the system is configured to use a primary and secondary authentication server with the following command:

cli% showauthparam
ldap-type MSAD
accounts-dn <accounts dn configuration>
super-map <super-map configuration>
edit-map <edit-map configuration>
browse-map <browse-map configuration>
service-map <service-map configuration>
ldap-StartTLS require
kerberos-realm <Kerberos-realm configuration>
ldap-2FA-cert-field subjectAlt:rfc822Name
ldap-2FA-object-attr mail
ldap-server <server hostname>
ldap-server <server hostname>
ldap-ssl-cacert:
-----BEGIN CERTIFICATE-----

If the command output does not list authparams for ldap-type, kerberos-realm, accounts-dn, ldap-ssl-cacert, and at least one role map (e.g., super-map), this is a finding.

If there are not two ldap-server lines, this is a finding.

ldap-StartTLS must be set to require, if not, this is a finding.

If the ldap-reqcert authparam is not set to "1", this is a finding.

Check Content Reference

M

Target Key

5742