The AAA Service must be configured to use Role-Based Access Control (RBAC) policy for levels of access authorization.
From Authentication Authorization and Accounting Service Security Requirements Guide
Part of SRG-APP-000329-AAA-000019
Associated with:
CCI-002169
SRG-APP-000329-AAA-000019_rule
The AAA Service must be configured to use Role-Based Access Control (RBAC) policy for levels of access authorization.
Vulnerability discussion
RBAC is an access control policy that restricts information system access to authorized users. Without these security policies, access control and enforcement mechanisms will not prevent unauthorized access.Organizations can create specific roles based on job functions and the authorizations (i.e., privileges) to perform needed operations on organizational information systems associated with the organization-defined roles. When users are assigned to the organizational roles, they inherit the authorizations or privileges defined for those roles. RBAC simplifies privilege administration for organizations because privileges are not assigned directly to every user (which can be a significant number of individuals for mid- to large-size organizations) but are instead acquired through role assignments. RBAC can be implemented either as a mandatory or discretionary form of access control.
Check content
Verify the AAA Service is configured to use RBAC policy for levels of access authorization. Confirm the RBAC groups have tiered privileges, and users are in the appropriate groups. In the following TACACS+ example the user (test-user) is a member of the group “test-group”.
$/opt/ciscosecure/CLI/ViewProfile -p 9900 -u user-test
User Profile Information
user = test-user{
profile_id = 66
profile_cycle = 1
member = test-group
password = des "********"
}
Below is an example of CiscoSecure TACACS+ server defining the privilege level.
user = test-user{
password = clear "xxxxx"
service = shell {
set priv-lvl = 7
}
}
If the AAA Service is not configured to use RBAC policy for levels of access authorization, this is a finding.
Fix text
Configure the AAA Service to use RBAC policy for levels of access authorization. Configure the AAA Service with standard accounts and assign them to privilege levels that meet their job description.
Pro Tips
Lavender hyperlinks in small type off to the right (of CSS
class id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle or
Accept: application/rdf+xml.
Powered by sagemincer