STIGQter: STIG Summary: Cisco IOS Router NDM Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 26 Apr 2021:

The Cisco router must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts.

DISA Rule

SV-215680r521266_rule

Vulnerability Number

V-215680

Group Title

SRG-APP-000156-NDM-000250

Rule Version

CISC-ND-000530

Severity

CAT II

CCI(s)

• CCI-001941 - The information system implements replay-resistant authentication mechanisms for network access to privileged accounts.

Weight

10

Fix Recommendation

Configure SSH to use FIPS-140-2 compliant HMACs as shown in the example below.

R1(config)#ip ssh version 2
R1(config)#ip ssh server algorithm encryption aes128-cbc aes192-cbc aes192-ctr

Note: An SSH configuration enables a server and client to authorize the negotiation of only those algorithms that are configured from the allowed list. If a user tries to negotiate using an algorithm that is not part of the allowed list, the request is rejected and the session is not established.

Check Contents

Review the Cisco router configuration to verify that SSH is configured to use FIPS-140-2 compliant HMACs as shown in the example below.

ip ssh version 2
ip ssh server algorithm encryption aes128-cbc aes192-cbc aes192-ctr

Note: An SSH configuration enables a server and client to authorize the negotiation of only those algorithms that are configured from the allowed list. If a remote party tries to negotiate using an algorithm that is not part of the allowed list, the request is rejected and the session is not established.

If the router is not configured to implement replay-resistant authentication mechanisms for network access to privileged accounts, this is a finding.

Vulnerability Number

V-215680

Documentable

False

Rule Version

CISC-ND-000530

Severity Override Guidance

Review the Cisco router configuration to verify that SSH is configured to use FIPS-140-2 compliant HMACs as shown in the example below.

ip ssh version 2
ip ssh server algorithm encryption aes128-cbc aes192-cbc aes192-ctr

Note: An SSH configuration enables a server and client to authorize the negotiation of only those algorithms that are configured from the allowed list. If a remote party tries to negotiate using an algorithm that is not part of the allowed list, the request is rejected and the session is not established.

If the router is not configured to implement replay-resistant authentication mechanisms for network access to privileged accounts, this is a finding.

Check Content Reference

M

Target Key

4014

Comments