The network device must implement replay-resistant authentication mechanisms for network access to privileged accounts.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-246849	HYCU-IA-000001	SV-246849r768211_rule		Medium

Description
A replay attack may enable an unauthorized user to gain access to the application. Authentication sessions between the authenticator and the application validating the user credentials must not be vulnerable to a replay attack. An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message. Techniques used to address this include protocols using nonces (e.g., numbers generated for a specific one-time use) or challenges (e.g., TLS, WS_Security). Additional techniques include time-synchronous or challenge-response one-time authenticators.

Description

A replay attack may enable an unauthorized user to gain access to the application. Authentication sessions between the authenticator and the application validating the user credentials must not be vulnerable to a replay attack. An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message. Techniques used to address this include protocols using nonces (e.g., numbers generated for a specific one-time use) or challenges (e.g., TLS, WS_Security). Additional techniques include time-synchronous or challenge-response one-time authenticators.

STIG	Date
HYCU for Nutanix Security Technical Implementation Guide	2021-08-03

Details

Check Text ( C-50281r768209_chk )
The use of SSH-2 protocol for network/remote access prevents replay attacks. The SSH-2 protocol is the standard for the SSH daemon in CentOS 8 used by HYCU. To determine the SSH version in use, log on to the HYCU console and execute the following command: ssh -v localhost If the output does not show remote protocol version 2.0 in use, this is a finding. HYCU web access uses TLS, which addresses this threat. HYCU web access cannot be configured not to use TLS.

Check Text ( C-50281r768209_chk )

The use of SSH-2 protocol for network/remote access prevents replay attacks. The SSH-2 protocol is the standard for the SSH daemon in CentOS 8 used by HYCU.

To determine the SSH version in use, log on to the HYCU console and execute the following command:
ssh -v localhost

If the output does not show remote protocol version 2.0 in use, this is a finding.

HYCU web access uses TLS, which addresses this threat. HYCU web access cannot be configured not to use TLS.

Fix Text (F-50235r768210_fix)
Log on to the HYCU console and configure SSH to use the SSH-2 protocol by editing the Protocol variable in the file "/etc/ssh/sshd_config".