Detections
Analytics

1.3 CISC-ND-000150

Information

The Cisco router must be configured to enforce the limit of three consecutive invalid logon attempts after which time lock out the user account from accessing the device for 15 minutes.

GROUP ID: V-216524RULE ID: SV-216524r960840

By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced.

Solution

Step 1: Configure the router to use an authentication server as shown in the following example:

RP/0/0/CPU0:R3(config)#radius-server host 10.1.3.16 key xxxxxxxx

Step 2: Configure the authentication order to use the authentication server as primary source for authentication as shown in the following example:

RP/0/0/CPU0:R3(config)#aaa authentication login LOGIN_AUTHENTICATION group radius local

Step 3: Configure all network connections associated with a device management to use an authentication server for the purpose of login authentication as shown in the following example:

RP/0/0/CPU0:R3(config)#line defaultRP/0/0/CPU0:R3(config-line)#login authentication LOGIN_AUTHENTICATIONRP/0/0/CPU0:R3(config-line)#exitRP/0/0/CPU0:R3(config)#line consoleRP/0/0/CPU0:R3(config-line)#login authentication LOGIN_AUTHENTICATION

See Also

https://workbench.cisecurity.org/benchmarks/23560

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-7a., CAT|II, CCI|CCI-000044, Rule-ID|SV-216524r960840_rule, STIG-ID|CISC-ND-000150, Vuln-ID|V-216524

Plugin: Cisco

Control ID: 6a7524d32ed79d43c4bd54c9626bf640633b08f23867c6039af9131d419d1e47