Check: F5BI-DM-000037
F5 BIG-IP Device Management STIG:
F5BI-DM-000037
(in versions v2 r3 through v1 r3)
Title
Upon successful logon, the BIG-IP appliance must be configured to notify the administrator of the date and time of the last logon. (Cat II impact)
Discussion
Administrators need to be aware of activity that occurs regarding their network device management account. Providing administrators with information regarding the date and time of their last successful logon allows them to determine if any unauthorized activity has occurred. This incorporates all methods of logon, including, but not limited to, SSH, HTTP, HTTPS, and physical connectivity.
Check Content
Verify the BIG-IP appliance is configured to use a remote authentication server to notify the administrator of the date and time of their last logon. Navigate to the BIG-IP System manager >> System >> Users >> Authentication. Verify "Authentication: User Directory" is configured for an approved remote authentication server to notify the administrator of the date and time of the last logon. If the administrator is not notified of the date and time of the last logon upon successful logon, this is a finding.
Fix Text
Configure the BIG-IP appliance to use an approved remote authentication server to notify the administrator of the date and time of the last logon upon successful logon.
Additional Identifiers
Rule ID: SV-228981r879887_rule
Vulnerability ID: V-228981
Group Title: SRG-APP-000516-NDM-000317
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000052 |
The information system notifies the user, upon successful logon (access) to the system, of the date and time of the last logon (access). |
CCI-000366 |
The organization implements the security configuration settings. |