The AAA Service must not be configured with group accounts.

From Authentication Authorization and Accounting Service Security Requirements Guide

Part of SRG-APP-000516-AAA-000062

Associated with: CCI-000366

SRG-APP-000516-AAA-000062_rule The AAA Service must not be configured with group accounts.

Vulnerability discussion

Group accounts configured for use on a network device do not allow for accountability or repudiation of individuals using the shared account. If group accounts are not changed when someone leaves the group, that person could possibly gain control of the network device. Having group accounts does not allow for proper auditing of who is accessing or changing the network. For this reason, group accounts are not permitted.

Check content

If the AAA Service relies on directory services for user account management this is not applicable and the connected directory services must perform this function. Verify the AAA Service is not configured with group accounts. Identify group profile definitions that do not meet the accounts user-id naming convention. Below is a super-user example of how an SA profile may be associated. Group Profile Information group = super-user{ profile_id = 40 profile_cycle = 1 service=shell { default cmd=permit cmd=debug { deny all permit .* } } } Below is an example of the user definition that should be assigned with a valid ID (not rtr-geek). Look for group accounts here: user = rtr-geek{ profile_id = 45 profile_cycle = 1 member = rtr_super password = des "********" } If the AAA Service is configured with group profiles, this is a finding.

Fix text

Configure the AAA Service with no group accounts. Remove all group profiles.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer