From F5 BIG-IP Local Traffic Manager 11.x Security Technical Implementation Guide
Part of SRG-NET-000138-ALG-000088
Associated with: CCI-000764
User account and privilege validation must be centralized in order to prevent unauthorized access using changed or revoked privileges.
If the BIG-IP Core does not provide user access control intermediary services for virtual servers, this is not applicable. When user access control intermediary services are provided, verify the BIG-IP Core is configured an APM policy with a pre-established trust relationship and mechanisms with appropriate authorities that validate each user access authorization and privileges. Navigate to the BIG-IP System manager >> Local Traffic >> Virtual Servers >> Virtual Servers List tab. Select Virtual Servers(s) from the list to verify. Verify under "Access Policy" section, that "Access Policy" has been set to use an APM access policy that has been configured with a pre-established trust relationship and mechanisms with appropriate authorities that validate each user access authorization and privileges. If the BIG-IP Core is not configured with a pre-established trust relationship and mechanisms with appropriate authorities that validate each user access authorization and privileges, this is a finding.
If user access control intermediary services are provided, configure the BIG-IP Core as follows: Configure a policy in the BIG-IP APM module with a pre-established trust relationship and mechanisms with appropriate authorities that validate each user access authorization and privileges. Apply the APM policy to the applicable Virtual Server(s) in the BIG-IP LTM module to validate user account access authorizations and privileges when providing access control to virtual servers.
Lavender hyperlinks in small type off to the right (of CSS
class id
, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle
or
Accept: application/rdf+xml
.
Powered by sagemincer