The IAO/NSO will ensure the AAA authentication method implements user authentication.

From Network Devices Security Technical Implementation Guide

Part of Group profiles defined in AAA server

SV-16260r1_rule The IAO/NSO will ensure the AAA authentication method implements user authentication.

Vulnerability discussion

Group accounts are not permitted.

Check content

Review the AAA server configuration. Attempt to identify suspicious group profile definitions that do not meet the accounts user-id naming convention. Example:supr-user. Below is an example of what an SA profile may be associated. Group Profile Information group = rtr_super{ profile_id = 40 profile_cycle = 1 service=shell { default cmd=permit cmd=debug { deny all permit .* } } } Below is an example of the user definition that should be assigned with a valid ID, (not rtr-geek). Look for group accounts here: user = rtr-geek{ profile_id = 45 profile_cycle = 1 member = rtr_super password = des "********" }

Fix text

Remove all group profiles from the AAA server.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.