Detections
Analytics

1.8 Host integrated hardware management controller must secure authentication

Information

Connections to centralized authentication sources, like Active Directory, should be disabled or carefully considered as attack vectors and dependency loops (for authentication, authorization, DNS, DHCP, and time). Consider managing local accounts on these devices through the APIs and CLI interfaces provided. If Active Directory must be used for authentication do authorization locally so that an attacker with access to Active Directory cannot promote themselves through group membership.

To prevent unauthorized access and potential malicious control of server hardware functions, it's essential to ensure that the integrated hardware management controller utilizes secure authentication mechanisms.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Recommended remediations by configuring authentication according to the approved security baseline:

 - Change all default passwords.
 - Disable or rename default accounts where the platform permits.
 - Create individually assigned administrator accounts.
 - Remove or disable unused accounts.
 - Enforce strong password complexity and minimum-length requirements.
 - Configure account lockout or login throttling after repeated authentication failures.
 - Enable MFA where supported.
 - Integrate the controller with approved centralized authentication such as Active Directory, LDAP, RADIUS, or TACACS+ where supported.
 - Use role-based access control and grant only the privileges required for each administrative role.
 - Disable anonymous or unauthenticated management services.
 - Restrict management access to approved management networks.
 - Ensure web, API, and remote-console authentication uses TLS or another encrypted transport.
 - Verify successful and failed authentication attempts are logged and forwarded to the approved logging system.

Impact:

Not connecting hardware management controllers to centralized authentication & authorization sources entails additional management. Most hardware management controllers have CLI toolkits or APIs to automate management of user accounts and/or authorization levels.

See Also

https://workbench.cisecurity.org/benchmarks/26357

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(2), 800-53|AC-6(5), CSCv7|4.3

Plugin: VMware

Control ID: 856db033de144fb4e1e684dd0a139c5774fe28e0483c2496530edead5395461f