From CA API Gateway NDM Security Technical Implementation Guide
Part of SRG-APP-000516-NDM-000336
Associated with: CCI-000366 CCI-000370
The use of authentication servers or other centralized management servers for providing centralized authentication services is required for network device management. Maintaining local administrator accounts for daily usage on each network device without centralized management is not scalable or feasible. Without centralized management, it is likely that credentials for some network devices will be forgotten, leading to delays in administration, which itself leads to delays in remediating production problems and in addressing compromises in a timely fashion.
Review the CA API Gateway configuration to determine if RADIUS + LDAPS or LDAPS is employed to centrally manage authentication settings. - SSH to SSG as a member of ssgconfig. - Select: 1) Configure system settings, 6) Export configuration. - Export configuration to "file". - Go back to main menu, select 3) Use a privileged shell (root). - Navigate to /home/ssgconfig, open "file". - Check "authenticationType". If "authenticationType" is not RADIUS_WITH_LDAP or RADIUS_WITH_LDAPS, this is a finding.
Configure the CA API Gateway to employ RADIUS + LDAPS or LDAPS to centrally manage authentication settings.
Prerequisites:
- RADIUS server (for the RADIUS+LDAPS configuration)
- LDAPS server with posixAccount objects for user logins
- LDAPS server CA certificate available via HTTP at a specific URL
- LDAP account for the SSG to bind and lookup info
- posixUser object within LDAP contain object (OU)
- All SSG LDAP posixAccount objects are filtered either by a fixed gidNumber or by membership in an LDAP group containing a sequence of memberUid attributes, one for each user.
Configure SSG to use LDAPS.
- SSH to SSG as a member of ssgconfig
- Select: 1) Configure system settings, 4) Configure authentication method.
- Select: 2) ldap.
- Walk through configuration steps, providing requisite information ensuring:
- Select LDAPS (secure) "y".
- Select the appropriate TLS port (636 is the default).
- Disable anonymous bind.
- Specify the URL containing the PEM of the CA certificate to download.
- Specify that the SSG LDAP client "demand" the server's certificate.
- Set the user filter to use either a specific gidNumber or a group DN.
- Set the posixAccount attribute to use as login name (uid).
Confirmation configuration should be approximately:
Authentication Type: LDAP_ONLY
Label | Value
---------------------------------------------------------------------------------------------
Secure | true
ActiveDirectory | false
Server | smldap.l7tech.com
BaseDn | dc=l7tech,dc=com
Port | 636
AnonymousBind | false
BindDn | cn=Manager,dc=l7tech,dc=com
BindPassword |
Lavender hyperlinks in small type off to the right (of CSS
class id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle or
Accept: application/rdf+xml.
Powered by sagemincer