Detections
Analytics

CCI|CCI-001941

Title

Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.

Reference Item Details

Category: 2024

Audit Items

View all Reference Audit Items

NamePluginAudit Name
AIX7-00-001012 - AIX must use the SSH server to implement replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.UnixDISA STIG AIX 7.x v3r1
ALMA-09-034340 - AlmaLinux OS 9 must use the CAC smart card driver.UnixDISA CloudLinux AlmaLinux OS 9 STIG v1r2
AOSX-13-000570 - The macOS system must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.UnixDISA STIG Apple Mac OSX 10.13 v2r5
APPL-11-000011 - The macOS system must disable the SSHD service.UnixDISA STIG Apple macOS 11 v1r8
APPL-11-000011 - The macOS system must disable the SSHD service.UnixDISA STIG Apple macOS 11 v1r5
APPL-14-001150 The macOS system must disable password authentication for SSH.UnixDISA Apple macOS 14 (Sonoma) STIG v2r3
APPL-14-003020 The macOS system must enforce smart card authentication.UnixDISA Apple macOS 14 (Sonoma) STIG v2r3
APPL-14-003030 The macOS system must allow smart card authentication.UnixDISA Apple macOS 14 (Sonoma) STIG v2r3
APPL-14-003050 The macOS system must enforce multifactor authentication for logon.UnixDISA Apple macOS 14 (Sonoma) STIG v2r3
APPL-14-003051 The macOS system must enforce multifactor authentication for the su command.UnixDISA Apple macOS 14 (Sonoma) STIG v2r3
APPL-14-003052 The macOS system must enforce multifactor authentication for privilege escalation through the sudo command.UnixDISA Apple macOS 14 (Sonoma) STIG v2r3
APPL-15-001150 - The macOS system must disable password authentication for SSH.UnixDISA Apple macOS 15 (Sequoia) STIG v1r3
APPL-15-003020 - The macOS system must enforce smart card authentication.UnixDISA Apple macOS 15 (Sequoia) STIG v1r3
APPL-15-003030 - The macOS system must allow smart card authentication.UnixDISA Apple macOS 15 (Sequoia) STIG v1r3
APPL-15-003050 - The macOS system must enforce multifactor authentication for login.UnixDISA Apple macOS 15 (Sequoia) STIG v1r3
APPL-15-003051 - The macOS system must enforce multifactor authentication for the su command.UnixDISA Apple macOS 15 (Sequoia) STIG v1r3
APPL-15-003052 - The macOS system must enforce multifactor authentication for privilege escalation through the sudo command.UnixDISA Apple macOS 15 (Sequoia) STIG v1r3
ARST-ND-000690 - The Arista network devices must use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.AristaDISA STIG Arista MLS EOS 4.2x NDM v2r1
CASA-ND-000470 - The Cisco ASA must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts.CiscoDISA STIG Cisco ASA NDM v2r2
Catalina - Enable SSH for Remote Access SessionsUnixNIST macOS Catalina v1.5.0 - All Profiles
CISC-ND-000530 - The Cisco router must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts.CiscoDISA Cisco IOS XR Router NDM STIG v3r3
CISC-ND-000530 - The Cisco switch must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts.CiscoDISA Cisco NX OS Switch NDM STIG v3r3
CISC-ND-001200 - The Cisco router must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.CiscoDISA STIG Cisco IOS XE Router NDM v3r2
CISC-ND-001200 - The Cisco router must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.CiscoDISA Cisco IOS Router NDM STIG v3r4
CISC-ND-001200 - The Cisco switch must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.CiscoDISA STIG Cisco IOS XE Switch NDM v3r2
CISC-ND-001200 - The Cisco switch must be configured to use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of remote maintenance sessions.CiscoDISA STIG Cisco IOS Switch NDM v3r2
DKER-EE-001070 - FIPS mode must be enabled on all Docker Engine - Enterprise nodes - docker info .SecurityOptionsUnixDISA STIG Docker Enterprise 2.x Linux/Unix v2r2
EDGE-00-000062 - The built-in DNS client must be disabled.WindowsDISA STIG Edge v2r2
ESXI-06-200037 - The VMM must implement replay-resistant authentication mechanisms for network access to privileged accounts by using Active Directory for local user authentication.VMwareDISA STIG VMware vSphere 6.x ESXi v1r5
ESXI-06-200038 - The VMM must implement replay-resistant authentication mechanisms for network access to privileged accounts by using the vSphere Authentication Proxy.VMwareDISA STIG VMware vSphere 6.x ESXi v1r5
ESXI-06-200039 - The VMM must implement replay-resistant authentication mechanisms for network access to privileged accounts by restricting use of Active Directory ESX Admin group membership.VMwareDISA STIG VMware vSphere 6.x ESXi v1r5
ESXI-67-000037 - The ESXi host must use Active Directory for local user authentication.VMwareDISA STIG VMware vSphere 6.7 ESXi v1r3
ESXI-67-000038 - ESXi hosts using Host Profiles and/or Auto Deploy must use the vSphere Authentication Proxy to protect passwords when adding themselves to Active Directory.VMwareDISA STIG VMware vSphere 6.7 ESXi v1r3
ESXI-67-000039 - Active Directory ESX Admin group membership must not be used when adding ESXi hosts to Active Directory.VMwareDISA STIG VMware vSphere 6.7 ESXi v1r3
ESXI-70-000037 - The ESXi host must use Active Directory for local user authentication.VMwareDISA STIG VMware vSphere 7.0 ESXi v1r4
ESXI-80-000049 - The ESXi host must uniquely identify and must authenticate organizational users by using Active Directory.VMwareDISA VMware vSphere 8.0 ESXi STIG v2r3
FGFW-ND-000205 - The FortiGate device must implement replay-resistant authentication mechanisms for network access to privileged accountsFortiGateDISA Fortigate Firewall NDM STIG v1r4
GEN005500 - The SSH daemon must be configured to only use the SSHv2 protocol.UnixDISA STIG Solaris 10 X86 v2r4
GEN005500 - The SSH daemon must be configured to only use the SSHv2 protocol.UnixDISA STIG Solaris 10 SPARC v2r4
JUEX-NM-000260 - The Juniper EX switch must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts.JuniperDISA Juniper EX Series Network Device Management v2r2
JUNI-ND-000530 - The Juniper router must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts.JuniperDISA STIG Juniper Router NDM v3r2
JUSX-DM-000124 - The Juniper SRX Services Gateway must implement replay-resistant authentication mechanisms for network access to privileged accounts.JuniperDISA Juniper SRX Services Gateway NDM v3r2
JUSX-VN-000031 - The Juniper SRX Services Gateway VPN must use anti-replay mechanisms for security associations.JuniperDISA Juniper SRX Services Gateway VPN v3r1
PANW-NM-000051 - The Palo Alto Networks security platform must implement replay-resistant authentication mechanisms for network access to privileged accounts.Palo_AltoDISA STIG Palo Alto NDM v3r2
PHTN-30-000026 - The Photon operating system must use an OpenSSH server version that does not support protocol 1.UnixDISA STIG VMware vSphere 7.0 Photon OS v1r4
PHTN-67-000068 - The Photon operating system must use OpenSSH for remote maintenance sessions.UnixDISA STIG VMware vSphere 6.7 Photon OS v1r6
RHEL-06-000227 - The SSH daemon must be configured to use only the SSHv2 protocol.UnixDISA Red Hat Enterprise Linux 6 STIG v2r2
RHEL-09-611160 - RHEL 9 must use the common access card (CAC) smart card driver.UnixDISA Red Hat Enterprise Linux 9 STIG v2r4
SHPT-00-000530 - The Central Administration Web Application must use Kerberos as the authentication provider.WindowsDISA STIG SharePoint 2010 v1r9
SHPT-00-000531 - SharePoint sites must not use NTLM - SharePoint sites must not use NTLM.WindowsDISA STIG SharePoint 2010 v1r9