Check: RCKS-NDM-000740
RUCKUS ICX NDM STIG:
RCKS-NDM-000740
(in version v1 r1)
Title
The RUCKUS ICX device must authenticate Network Time Protocol sources using authentication that is cryptographically based. (Cat II impact)
Discussion
If Network Time Protocol (NTP) is not authenticated, an attacker can introduce a rogue NTP server. This rogue server can then be used to send incorrect time information to network devices, which will make log timestamps inaccurate and affect scheduled actions. NTP authentication is used to prevent this tampering by authenticating the time source.
Check Content
View NTP configuration: SSH@ICX# show running-config | begin ntp ntp disable authenticate md5 authenticate authentication-key key-id 1 sha1 2 $VWlkRGkt server x.x.x.x key 1 server y.y.y.y key 1 If the NTP servers are not configured for authentication that is cryptographically based, this is a finding.
Fix Text
Configure NTP for authentication using SHA1: SSH@ICX(config)# ntp SSH@ICX(config-ntp)# disable authenticate md5 SSH@ICX(config-ntp)# authenticate SSH@ICX(config-ntp)# authentication-key key-id 1 sha1 [password]
Additional Identifiers
Rule ID: SV-273826r1110846_rule
Vulnerability ID: V-273826
Group Title: SRG-APP-000395-NDM-000347
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-001967 |
Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based. |
Controls
| Number | Title |
|---|---|
| IA-3(1) |
Cryptographic Bidirectional Authentication |