Page 20 of 72
6. Configure vty lines to accept ‘ssh’ login services
TOE-common-criteria(config-line)# transport input ssh
7. Configure a SSH client to support only the following specific encryption algorithms:
o AES-CBC-128
o AES-CBC-256
peer#ssh -l cisco -c aes128-cbc 1.1.1.1
peer#ssh -l cisco -c aes256-cbc 1.1.1.1
8. Configure a SSH client to support message authentication. Only the following MACs are
allowed and “None” for MAC is not allowed:
a. hmac-sha1-96
b. hmac-sha1
peer#ssh -l cisco -m hmac-sha1-96 1.1.1.1
9. Configure the SSH rekey time-based rekey and volume-based rekey values (values can be
configured to be lower than the default values if a shorter interval is desired):
a. ip ssh rekey time 60
b. ip ssh rekey volume 1000000
HTTP and HTTPS servers were not evaluated and must be disabled: no ip http server
no ip http secure-server
SNMP server was not evaluated and must be disabled: no snmp-server
3.3.2 Authentication Server Protocols
RADIUS (outbound) for authentication of TOE administrators to remote authentication
servers are disabled by default but should be enabled by administrators in the evaluated
configuration.
o To configure RADIUS refer to [17] Under Configure Click on Configuration
Guides Security, Services, and VPN Click on Securing User Services
Configuration Guide Library click on Authentication, Authorization, and
Accounting (AAA) Configuration Guide Configuring Authentication How to
Configure AAA Authentication Methods Configuring Login Authentication
Using AAA Login Authentication Using Group RADIUS. Use best practices
for the selection and protection of a key to ensure that the key is not easily
guessable and is not shared with unauthorized users.
This protocol is to be tunneled over an IPsec connection in the evaluated configuration. The
instructions for setting up this communication are the same as those for protecting
communications with a syslog server, detailed in Section 3.3.4 below.
3.3.3 Logging Configuration
Logging of command execution must be enabled: [10] Cisco IOS Configuration Fundamentals
Command Reference and Cisco IOS Debug Command References
To Next Page
Loading...
Need help?
General
