From Network Devices Security Technical Implementation Guide
Part of Dial-up access doesn't use 2-factor authentication
Associated with IA controls: EBRP-1
A communications server (aka terminal server) can be used to provide interconnectivity between all managed network elements and the OOBM gateway router for administrative access to the device’s console port. In the event the OOBM network is not able to provide connectivity due to an outage, the communications server can provide a dial-up PPP connection to access a network element. The auxiliary port, consol port, as well as any slow-speed async serial port with an analog modem connected to the managed device also provides the capability for direct dial-up administrative access for infrastructures that do not have a communications server for management access.
Review the communications server configuration and verify that PPP connections require AAA authentication using a RADIUS or TACACS+ authentication server. aaa new-model aaa authentication ppp list-name tacacs+ local .. tacacs-server host 200.200.2.2 tacacs-server host 300.300.3.3 Upon verifying that an AAA server is used for authenticating dial-up connections to the communications server, review the AAA server to ensure two-factor is used.
Configure the communications server to use an AAA server to authenticate all administrators authorized for dial-up access using 2-factor authentication.
Lavender hyperlinks in small type off to the right (of CSS
class id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle or
Accept: application/rdf+xml.
Powered by sagemincer