STIGQter: STIG Summary: A10 Networks ADC NDM Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 15 Apr 2016:

The A10 Networks ADC must implement replay-resistant authentication mechanisms for network access to privileged accounts.

DISA Rule

SV-82543r1_rule

Vulnerability Number

V-68053

Group Title

SRG-APP-000156-NDM-000250

Rule Version

AADC-NM-000052

Severity

CAT II

CCI(s)

• CCI-001941 - The information system implements replay-resistant authentication mechanisms for network access to privileged accounts.

Weight

10

Fix Recommendation

Since the device supports RADIUS, TACACS+, and LDAP, one of these must be configured. The following is a sample configuration for TACACS+.

The following command sets the authentication method to TACACS+ for administrative access to the device:
authentication type tacplus

The local database (local option) must be included as one of the authentication sources, regardless of the order is which the sources are used. Authentication using only a remote server is not supported.

The following command configures the device to use a TACACS+ server:
tacacs-server host [hostname | ipaddr] secret [secret-string]
"hostname | ipaddr" is the hostname or IP address of the TACACS+ server.
"secret-string" is the secret key to authenticate the switch to the TACACS+ server.

Up to two TACACS+ servers can be configured. The secondary server is used only if the primary server does not respond. The servers are used in the order in which you add them to the configuration. Use a separate command for each of the servers.

If RADIUS is used, the device must be the FIPS version of the platform. The FIPS version of the platform is identified by the designation "FIPS" in the stock keeping unit (SKU) when purchasing the device. It is imperative that the correct version of the device be procured.

Check Contents

Review the device configuration.

Since the device supports RADIUS, TACACS+, and LDAP, one of these must be configured. The following is a sample verification for TACACS+.

The following command shows the parts of the configuration with the word "tacplus":
show run | inc tacplus

If the output is blank, this is a finding.

The following command shows information for all configured TACACS servers:
show tacacs-server

If no servers are configured, this is a finding.

If RADIUS is used, ask the Administrator whether or not the device is a FIPS version of the platform. This is identified by the designation "FIPS" in the stock keeping unit (SKU).

The following command shows the version of ACOS used and other related information:
show version

If the output does not include "Platform features: fips", this is a finding.

Vulnerability Number

V-68053

Documentable

False

Rule Version

AADC-NM-000052

Severity Override Guidance

Review the device configuration.

Since the device supports RADIUS, TACACS+, and LDAP, one of these must be configured. The following is a sample verification for TACACS+.

The following command shows the parts of the configuration with the word "tacplus":
show run | inc tacplus

If the output is blank, this is a finding.

The following command shows information for all configured TACACS servers:
show tacacs-server

If no servers are configured, this is a finding.

If RADIUS is used, ask the Administrator whether or not the device is a FIPS version of the platform. This is identified by the designation "FIPS" in the stock keeping unit (SKU).

The following command shows the version of ACOS used and other related information:
show version

If the output does not include "Platform features: fips", this is a finding.

Check Content Reference

M

Target Key

2915

Comments