ONTAP must implement replay-resistant authentication mechanisms for network access to privileges accounts.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-246948	NAOT-IA-000002	SV-246948r769176_rule		Medium

Description
A replay attack may enable an unauthorized user to gain access to the application. Authentication sessions between the authenticator and the application validating the user credentials must not be vulnerable to a replay attack. An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message. Techniques used to address this include protocols using nonces (e.g., numbers generated for a specific one-time use) or challenges (e.g., TLS, WS_Security). Additional techniques include time-synchronous or challenge-response one-time authenticators.

Description

A replay attack may enable an unauthorized user to gain access to the application. Authentication sessions between the authenticator and the application validating the user credentials must not be vulnerable to a replay attack. An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message. Techniques used to address this include protocols using nonces (e.g., numbers generated for a specific one-time use) or challenges (e.g., TLS, WS_Security). Additional techniques include time-synchronous or challenge-response one-time authenticators.

STIG	Date
NetApp ONTAP DSC 9.x Security Technical Implementation Guide	2021-07-28

Details

Check Text ( C-50380r769174_chk )
Use "security login show -role admin -authentication-method domain" to see all configured admin users and groups that authenticate using active directory. If ONTAP cannot be configured to use replay-resistant authentication mechanisms for network access to privileges, this is a finding.

Fix Text (F-50334r769175_fix)
Configure new administrator active directory users or groups with "security login create -user-or-group-name -role admin -authentication-method domain".