Check: ARST-ND-000150
Arista MLS EOS 4.2x NDM STIG:
ARST-ND-000150
(in version v1 r1)
Title
The Arista network device must be configured to audit all administrator activity. (Cat II impact)
Discussion
This requirement supports non-repudiation of actions taken by an administrator and is required in order to maintain the integrity of the configuration management process. All configuration changes to the network device are logged, and administrators authenticate with two-factor authentication before gaining administrative access. Together, these processes will ensure the administrators can be held accountable for the configuration changes they implement. Satisfies: SRG-APP-000026-NDM-000208, SRG-APP-000027-NDM-000209, SRG-APP-000028-NDM-000210, SRG-APP-000029-NDM-000211, SRG-APP-000080-NDM-000220, SRG-APP-000091-NDM-000223, SRG-APP-000101-NDM-000231, SRG-APP-000319-NDM-000283, SRG-APP-000343-NDM-000289, SRG-APP-000495-NDM-000318, SRG-APP-000499-NDM-000319, SRG-APP-000503-NDM-000320, SRG-APP-000504-NDM-000321, SRG-APP-000506-NDM-000323
Check Content
Verify the Arista network device is configured to audit all administrator activity. Verify the AAA logging settings in the configuration file with the following example: switch#show running-config | section aaa aaa authentication policy on-success log aaa authentication policy on-failure log aaa accounting exec default start-stop group radius logging aaa accounting system default start-stop group radius logging aaa accounting commands all default start-stop logging group radius If the Arista network device is not configured to audit all administrator activity, this is a finding.
Fix Text
Configure the Arista network device to audit all administrator activity. Configure the AAA settings to capture administrator activity events. switch(config)#aaa authentication policy on-success log switch(config)#aaa authentication policy on-failure log switch(config)#aaa accounting exec default start-stop group radius logging switch(config)#aaa accounting system default start-stop group radius logging switch(config)#aaa accounting commands all default start-stop logging group radius
Additional Identifiers
Rule ID: SV-255951r882195_rule
Vulnerability ID: V-255951
Group Title: SRG-APP-000026-NDM-000208
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000018 |
The information system automatically audits account creation actions. |
CCI-000135 |
The information system generates audit records containing the organization-defined additional, more detailed information that is to be included in the audit records. |
CCI-000166 |
The information system protects against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation. |
CCI-000172 |
The information system generates audit records for the events defined in AU-2 d. with the content defined in AU-3. |
CCI-001403 |
The information system automatically audits account modification actions. |
CCI-001404 |
The information system automatically audits account disabling actions. |
CCI-001405 |
The information system automatically audits account removal actions. |
CCI-002130 |
The information system automatically audits account enabling actions. |
CCI-002234 |
The information system audits the execution of privileged functions. |