Detections
Analytics

800-53|IA-2(9)

Title

NETWORK ACCESS TO NON-PRIVILEGED ACCOUNTS - REPLAY RESISTANT

Description

The information system implements replay-resistant authentication mechanisms for network access to non-privileged accounts.

Supplemental

Authentication processes resist replay attacks if it is impractical to achieve successful authentications by recording/replaying previous authentication messages. Replay-resistant techniques include, for example, protocols that use nonces or challenges such as Transport Layer Security (TLS) and time synchronous or challenge-response one-time authenticators.

Reference Item Details

Category: IDENTIFICATION AND AUTHENTICATION

Parent Title: IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS)

Family: IDENTIFICATION AND AUTHENTICATION

Baseline Impact: HIGH

Audit Items

View all Reference Audit Items

NamePluginAudit Name
AIX7-00-001012 - AIX must use the SSH server to implement replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.UnixDISA STIG AIX 7.x v2r9
AOSX-13-000570 - The macOS system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.UnixDISA STIG Apple Mac OSX 10.13 v2r5
AOSX-14-000040 - The macOS system must use replay-resistant authentication mechanisms and implement cryptographic mechanisms to protect the integrity of and verify remote disconnection at the termination of nonlocal maintenance and diagnostic communications, when used for nonlocal maintenance sessions - OpenSSH VersionUnixDISA STIG Apple Mac OSX 10.14 v2r6
AOSX-14-000040 - The macOS system must use replay-resistant authentication mechanisms and implement cryptographic mechanisms to protect the integrity of and verify remote disconnection at the termination of nonlocal maintenance and diagnostic communications, when used for nonlocal maintenance sessions - SSHD currently runningUnixDISA STIG Apple Mac OSX 10.14 v2r6
AOSX-14-000040 - The macOS system must use replay-resistant authentication mechanisms and implement cryptographic mechanisms to protect the integrity of and verify remote disconnection at the termination of nonlocal maintenance and diagnostic communications, when used for nonlocal maintenance sessions - SSHD service disabledUnixDISA STIG Apple Mac OSX 10.14 v2r6
AOSX-15-000011 - The macOS system must implement DoD-approved encryption to protect the confidentiality and integrity of remote access sessions, including transmitted data and data during preparation for transmission, and use replay-resistant authentication mechanisms and implement cryptographic mechanisms to protect the integrity of and verify remote disconnection at the termination of nonlocal maintenance and diagnostic communications - OpenSSH versionUnixDISA STIG Apple Mac OSX 10.15 v1r10
AOSX-15-000011 - The macOS system must implement DoD-approved encryption to protect the confidentiality and integrity of remote access sessions, including transmitted data and data during preparation for transmission, and use replay-resistant authentication mechanisms and implement cryptographic mechanisms to protect the integrity of and verify remote disconnection at the termination of nonlocal maintenance and diagnostic communications - SSHD currently runningUnixDISA STIG Apple Mac OSX 10.15 v1r10
AOSX-15-000011 - The macOS system must implement DoD-approved encryption to protect the confidentiality and integrity of remote access sessions, including transmitted data and data during preparation for transmission, and use replay-resistant authentication mechanisms and implement cryptographic mechanisms to protect the integrity of and verify remote disconnection at the termination of nonlocal maintenance and diagnostic communications - SSHD service disabledUnixDISA STIG Apple Mac OSX 10.15 v1r10
APPL-11-000011 - The macOS system must disable the SSHD service.UnixDISA STIG Apple macOS 11 v1r8
APPL-11-000011 - The macOS system must disable the SSHD service.UnixDISA STIG Apple macOS 11 v1r5
Catalina - Enable SSH for Remote Access SessionsUnixNIST macOS Catalina v1.5.0 - All Profiles
EDGE-00-000062 - The built-in DNS client must be disabled.WindowsDISA STIG Edge v1r7
ESXI-06-300037 - The VMM must implement replay-resistant authentication mechanisms for network access to non-privileged accounts by using Active Directory for local user authentication.VMwareDISA STIG VMware vSphere 6.x ESXi v1r5
ESXI-06-300038 - The VMM must implement replay-resistant authentication mechanisms for network access to non-privileged accounts by using the vSphere Authentication Proxy.VMwareDISA STIG VMware vSphere 6.x ESXi v1r5
ESXI-06-300039 - The VMM must implement replay-resistant authentication mechanisms for network access to non-privileged accounts by restricting use of Active Directory ESX Admin group membership.VMwareDISA STIG VMware vSphere 6.x ESXi v1r5
ESXI-67-000037 - The ESXi host must use Active Directory for local user authentication.VMwareDISA STIG VMware vSphere 6.7 ESXi v1r3
ESXI-67-000038 - ESXi hosts using Host Profiles and/or Auto Deploy must use the vSphere Authentication Proxy to protect passwords when adding themselves to Active Directory.VMwareDISA STIG VMware vSphere 6.7 ESXi v1r3
ESXI-67-000039 - Active Directory ESX Admin group membership must not be used when adding ESXi hosts to Active Directory.VMwareDISA STIG VMware vSphere 6.7 ESXi v1r3
ESXI-70-000037 - The ESXi host must use Active Directory for local user authentication.VMwareDISA STIG VMware vSphere 7.0 ESXi v1r2
JUSX-VN-000031 - The Juniper SRX Services Gateway VPN must use anti-replay mechanisms for security associations.JuniperDISA Juniper SRX Services Gateway VPN v2r2
PHTN-30-000026 - The Photon operating system must use an OpenSSH server version that does not support protocol 1.UnixDISA STIG VMware vSphere 7.0 Photon OS v1r2
PHTN-67-000068 - The Photon operating system must use OpenSSH for remote maintenance sessions.UnixDISA STIG VMware vSphere 6.7 Photon OS v1r6
RHEL-09-611160 - RHEL 9 must use the CAC smart card driver.UnixDISA Red Hat Enterprise Linux 9 STIG v1r2
SOL-11.1-050240 - The boundary protection system (firewall) must be configured to deny network traffic by default and must allow network traffic by exception (i.e., deny all, permit by exception).UnixDISA STIG Solaris 11 SPARC v2r9
SOL-11.1-050240 - The boundary protection system (firewall) must be configured to deny network traffic by default and must allow network traffic by exception (i.e., deny all, permit by exception).UnixDISA STIG Solaris 11 X86 v2r9
SYMP-AG-000380 - Symantec ProxySG providing user authentication intermediary services must implement replay-resistant authentication mechanisms for network access to nonprivileged accounts.BlueCoatDISA Symantec ProxySG Benchmark ALG v1r3
UBTU-16-030200 - The Ubuntu operating system must enforce SSHv2 for network access to all accounts.UnixDISA STIG Ubuntu 16.04 LTS v2r3
UBTU-18-010412 - The Ubuntu operating system must enforce SSHv2 for network access to all accounts.UnixDISA STIG Ubuntu 18.04 LTS v2r13
VCSA-70-000009 - The vCenter Server must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination using remote access.VMwareDISA STIG VMware vSphere 7.0 vCenter v1r2
WN12-AC-000014-DC - The computer clock synchronization tolerance must be limited to 5 minutes or less.WindowsDISA Windows Server 2012 and 2012 R2 DC STIG v3r7
WN16-DC-000020 - Kerberos user logon restrictions must be enforced.WindowsDISA Windows Server 2016 STIG v2r7
WN16-DC-000030 - The Kerberos service ticket maximum lifetime must be limited to 600 minutes or less.WindowsDISA Windows Server 2016 STIG v2r7
WN16-DC-000040 - The Kerberos user ticket lifetime must be limited to 10 hours or less.WindowsDISA Windows Server 2016 STIG v2r7
WN16-DC-000050 - The Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less.WindowsDISA Windows Server 2016 STIG v2r7
WN16-DC-000060 - The computer clock synchronization tolerance must be limited to 5 minutes or less.WindowsDISA Windows Server 2016 STIG v2r7
WN19-DC-000020 - Windows Server 2019 Kerberos user logon restrictions must be enforced.WindowsDISA Windows Server 2019 STIG v2r8
WN19-DC-000030 - Windows Server 2019 Kerberos service ticket maximum lifetime must be limited to 600 minutes or less.WindowsDISA Windows Server 2019 STIG v2r8
WN19-DC-000040 - Windows Server 2019 Kerberos user ticket lifetime must be limited to 10 hours or less.WindowsDISA Windows Server 2019 STIG v2r8
WN19-DC-000050 - Windows Server 2019 Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less.WindowsDISA Windows Server 2019 STIG v2r8
WN19-DC-000060 - Windows Server 2019 computer clock synchronization tolerance must be limited to five minutes or less.WindowsDISA Windows Server 2019 STIG v2r8
WN22-DC-000020 - Windows Server 2022 Kerberos user logon restrictions must be enforced.WindowsDISA Windows Server 2022 STIG v1r4
WN22-DC-000030 - Windows Server 2022 Kerberos service ticket maximum lifetime must be limited to 600 minutes or less.WindowsDISA Windows Server 2022 STIG v1r4
WN22-DC-000040 - Windows Server 2022 Kerberos user ticket lifetime must be limited to 10 hours or less.WindowsDISA Windows Server 2022 STIG v1r4
WN22-DC-000050 - Windows Server 2022 Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less.WindowsDISA Windows Server 2022 STIG v1r4
WN22-DC-000060 - Windows Server 2022 computer clock synchronization tolerance must be limited to five minutes or less.WindowsDISA Windows Server 2022 STIG v1r4