Detections
Analytics
ARBA-ND-000259 - AOS must transmit only encrypted representations of passwords.
Information
Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised.Network devices can accomplish this by making direct function calls to encryption modules or by leveraging operating system encryption capabilities.
Solution
Configure AOS with the following commands:configure terminal
aaa authentication-server ldap <server name>
authport 636
preferred-conn-type ldap-s
exit
snmp-server user <username> auth-prot sha <passphrase> priv-prot AES <passphrase>
write memory
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_HPE_Aruba_Networking_AOS_Y26M04_STIG.zip
Item Details
Audit Name: DISA HPE Aruba Networking AOS NDM STIG v1r1
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-5(1)(c), CAT|I, CCI|CCI-000197, Rule-ID|SV-266937r1039832_rule, STIG-ID|ARBA-ND-000259, Vuln-ID|V-266937
Plugin: ArubaOS
Control ID: eaf326546f56d4dd336dead86bb4dc81f15d2d7b49622cd79873cc90651fd3a1