Check: AMLS-NM-200825
Arista MLS DCS-7000 Series NDM STIG:
AMLS-NM-200825
(in versions v1 r3 through v1 r2)
Title
The Arista Multilayer Switch must use FIPS-compliant mechanisms for authentication to a cryptographic module. (Cat II impact)
Discussion
Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and DoD data may be compromised. Network devices utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DoD requirements.
Check Content
Review the device configuration via the “show running-config” command for the following statement: management ssh fips restrictions If this statement is not present, this is a finding.
Fix Text
Enable FIPS restrictions via the following commands: Enable Configure Management ssh Fips restrictions Exit Additionally, the switch should be configured to use its Hardware Random Number Generator as a source of entropy for the SSH protocol. To enable this, configure: Enable Configure Management security Entropy source hardware Once this has been changed, regenerate the SSH RSA Keys with: Reset ssh hostkey rsa
Additional Identifiers
Rule ID: SV-81687r1_rule
Vulnerability ID: V-67197
Group Title: SRG-APP-000179-NDM-000265
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000803 |
The information system implements mechanisms for authentication to a cryptographic module that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication. |
Controls
Number | Title |
---|---|
IA-7 |
Cryptographic Module Authentication |