The HP FlexFabric Switch must have a local account that will only be used as an account of last resort with full access to the network device.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-66295	HFFS-ND-000140	SV-80785r1_rule		High

Description
In the event the network device loses connectivity to the management network authentication service, only a local account can gain access to the switch to perform configuration and maintenance. Without this capability, the network device is inaccessible to administrators.

STIG	Date
HP FlexFabric Switch NDM Security Technical Implementation Guide	2020-06-03

Details

Check Text ( C-66941r1_chk )
Verify that the switch is configured with a local user that has full access by entering the following command: display local-user user-name . The user role list should contain the following: network-admin, network-operator If the switch does not have a local user with full access, this is a finding.

Fix Text (F-72371r1_fix)
Configure the switch with a local user account that has network-admin and network-operator role. [5900]local-user adminxxx [5900-luser-manage-adminxxx]authorization-attribute user-role network-admin (or level=15) [5900-luser-manage-adminxxx]authorization-attribute user-role network-operator [5900-luser-manage-adminxxx]service-type terminal [5900-luser-manage-adminxxx]password hash xxxxxxxxxxxxxx