V-283785

Discussion

Centralized management of authentication settings increases the security of remote and nonlocal access methods. This control is particularly important protection against the insider threat. With robust centralized management, audit records for administrator account access to the organization's network devices can be more readily analyzed for trends and anomalies. The alternative method of defining administrator accounts on each device exposes the device configuration to remote access authentication attacks and system administrators with multiple authenticators for each device.

Check Content

Review the Nokia router configuration to verify the device is configured to use at least two authentication servers as the primary source for authentication.

Verify multiple authentication servers are configured and status is "up", as shown in the example below:

- show system security authentication statistics
show system security authentication statistics

Authentication sequence : radius tacplus ldap local

type status timeout (secs) retry count
 server address retry timeout
 server name (secs)

radius up 3 3
 192.168.0.10:1812 n/a
tacplus up 3 n/a
 192.168.1.10:49 300
ldap up 3 3
 10.1.1.1:389 n/a
 Corporate LDAP Server

radius admin/oper status : up/up
 UDP port : 1812
 TCP port : 2083
tacplus admin/oper status : up/up
ldap admin/oper status : up/up
health check : enabled (interval 30 secs)

No. of Servers: 3

If the Nokia router is not configured to use at least two authentication servers for authenticating users prior to granting administrative access, this is a finding.