CISC-ND-000530 - The Cisco router must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts - ssh version

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version


A replay attack may enable an unauthorized user to gain access to the application. Authentication sessions between the authenticator and the application validating the user credentials must not be vulnerable to a replay attack.

An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message.

Techniques used to address this include protocols using nonces (e.g., numbers generated for a specific one-time use) or challenges (e.g., TLS, WS_Security). Additional techniques include time-synchronous or challenge-response one-time authenticators.


Configure the router to use SSH version 2 as shown in the example below.

RP/0/0/CPU0:R3(config)#ssh server v2

See Also

Item Details

References: CAT|II, CCI|CCI-001941, Rule-ID|SV-216531r879597_rule, STIG-ID|CISC-ND-000530, STIG-Legacy|SV-105551, STIG-Legacy|V-96413, Vuln-ID|V-216531

Plugin: Cisco

Control ID: 303063d067248083979a4c4158036b2ef7d75249bfb335f2cb067152df799c41