The Cisco router must notify the administrator, upon successful logon (access), of the location of last logon (terminal or IP address) in addition to the date and time of the last logon (access).

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-96295	CISC-ND-000960	SV-105433r1_rule		Medium

Description

Administrators need to be aware of activity that occurs regarding their account. Providing them with information deemed important by the organization may aid in the discovery of unauthorized access or thwart a potential attacker. Organizations should consider the risks to the specific information system being accessed and the threats presented by the device to the environment when configuring this option. An excessive or unnecessary amount of information presented to the administrator at logon is not recommended.

STIG	Date
Cisco IOS XE Router NDM Security Technical Implementation Guide	2019-12-20

Details

Check Text ( C-95129r1_chk )

The Cisco router is not compliant with this requirement. However, the risk associated with this requirement can be fully mitigated if the router is configured to utilize an authentication server to authenticate and authorize users for administrative access. Review the router configuration to verify that the device is configured to use an authentication server as primary source for authentication as shown in the following example: aaa new-model ! aaa authentication login LOGIN_AUTHENTICATION group radius local … … … ip http authentication aaa login-authentication LOGIN_AUTHENTICATION ip http secure-server … … … radius-server host x.x.x.x auth-port 1645 acct-port 1646 key xxxxxxx … … … line con 0 exec-timeout 10 0 login authentication LOGIN_AUTHENTICATION line vty 0 4 exec-timeout 10 0 login authentication LOGIN_AUTHENTICATION If the router is not configured to use an authentication server to authenticate and authorize users for administrative access, this is a finding.

Fix Text (F-101971r1_fix)

Step 1: Configure the Cisco router to use an authentication server as shown in the following example: R4(config)#radius host 10.1.48.2 key xxxxxx Step 2: Configure the authentication order to use the authentication server as primary source for authentication as shown in the following example: R4(config)#aaa authentication login LOGIN_AUTHENTICATION group radius local Step 3: Configure all network connections associated with a device management to use an authentication server for the purpose of login authentication. R4(config)#line vty 0 4 R4(config-line)#login authentication LOGIN_AUTHENTICATION R4(config-line)#exit R4(config)#line con 0 R4(config-line)#login authentication LOGIN_AUTHENTICATION R4(config-line)#exit R4(config)#ip http authentication aaa login-authentication LOGIN_AUTHENTICATION