The Cisco router must allow the use of a temporary password for system logons with an immediate change to a permanent password.
Without providing this capability, an account may be created without a password. Non-repudiation cannot be guaranteed once an account is created if a user is not forced to change the temporary password upon initial login.
Temporary passwords are typically used to allow access to applications when new accounts are created or passwords are changed. It is common practice for administrators to create temporary passwords for user accounts that allow the users to log in yet force them to change the password once they have successfully authenticated.
The Cisco router is not compliant with this requirement. However, the risk associated with this requirement can be fully mitigated if the router is configured to utilize an authentication server to authenticate and authorize users for administrative access.
Review the router configuration to verify that the device is configured to use an authentication server as primary source for authentication as shown in the following example:
aaa new-model ! aaa authentication login LOGIN_AUTHENTICATION group radius local … … … ip http authentication aaa login-authentication LOGIN_AUTHENTICATION ip http secure-server … … … radius-server host x.x.x.x auth-port 1645 acct-port 1646 key xxxxxxx … … … line con 0 exec-timeout 10 0 login authentication LOGIN_AUTHENTICATION line vty 0 4 exec-timeout 10 0 login authentication LOGIN_AUTHENTICATION
If the router is not configured to use an authentication server to authenticate and authorize users for administrative access, this is a finding.
Fix Text (F-102001r1_fix)
Step 1: Configure the Cisco router to use an authentication server as shown in the following example:
R4(config)#radius host 10.1.48.2 key xxxxxx
Step 2: Configure the authentication order to use the authentication server as primary source for authentication as shown in the following example:
R4(config)#aaa authentication login LOGIN_AUTHENTICATION group radius local
Step 3: Configure all network connections associated with a device management to use an authentication server for the purpose of login authentication.