Network devices must provide a logoff capability for administrator-initiated communication sessions.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-66225	HFFS-ND-000082	SV-80715r1_rule		Medium

Description
If an administrator cannot explicitly end a device management session, the session may remain open and be exploited by an attacker; this is referred to as a zombie session.

STIG	Date
HP FlexFabric Switch NDM Security Technical Implementation Guide	2019-09-27

Details

Check Text ( C-66871r1_chk )
Review the HP FlexFabric Switch configuration to determine if it provides a logoff capability for administrator-initiated communication sessions. [HP] display users Idx Line Idle Time Pid Type + 177 VTY 0 00:00:00 May 29 15:45:11 1011 SSH Following are more details. VTY 0 : User name: admin@system Location: 16.117.204.17 + : Current operation user. F : Current operation user works in async mode. If the HP FlexFabric Switch does not provide a logoff capability for these sessions, this is a finding.

Check Text ( C-66871r1_chk )

Review the HP FlexFabric Switch configuration to determine if it provides a logoff capability for administrator-initiated communication sessions.

[HP] display users

Idx Line Idle Time Pid Type
+ 177 VTY 0 00:00:00 May 29 15:45:11 1011 SSH

Following are more details.
VTY 0 :
User name: admin@system
Location: 16.117.204.17
+ : Current operation user.
F : Current operation user works in async mode.

If the HP FlexFabric Switch does not provide a logoff capability for these sessions, this is a finding.

Fix Text (F-72301r1_fix)
Configure the HP FlexFabric Switch to provide a logoff capability for administrator-initiated communication sessions. [HP] Ctrl + z quit