Audits Tenable ZTE ROSNG Changelog Revision 1.5 ChangelogRevision 1.5Dec 27, 2023 Informational Update 1.1 Secure Login and Telnet Disabling - Disable telnet server 1.1 Secure Login and Telnet Disabling - Enable SSH server 1.2 Password Security Policy - a) The default password length shouldn't be below 8 characters 1.2 Password Security Policy - b) The password must include either three of 'number', 'capital', 'lowercase', 'special-character' or set the 'character-set-num' value to 3-4 1.2 Password Security Policy - c) Configure 'strong-password dictionary' and 'same-consecutive' to avoid weak password - same-consecutive 1.2 Password Security Policy - c) Configure 'strong-password dictionary' and 'same-consecutive' to avoid weak password - strong-password dictionary 1.2 Password Security Policy - d) Check either of the following words exist in configuration file 1.2 Password Security Policy - e) Check for strong-password max-length 1.2 Password Security Policy - e) Check for strong-password max-length - strong-password date-check enable 1.2 Password Security Policy - e) Check for strong-password max-length - strong-password username-related-chk inverse 1.2 Password Security Policy - f) The validity period of an account can be configured 1.3 Account Anti-riot Attack 1.4 SNMP Security - a) SNMP Community Security 1.4 SNMP Security - b) SNMP server 1.4 SNMP Security - c) SNMP Security Protection Function 1.5 FTP/SFTP Access Authorization 1.5 FTP/SFTP Access Authorization - login-type-allowed 1.5 FTP/SFTP Access Authorization - sftp top-directory 1.6 Support Web Access Security - a) ciphersuite 1.6 Support Web Access Security - b) ssl-context field 1.6 Support Web Access Security - c) version 1.7 Log Auditing 1.8 SSH Strong Algorithm - a) Disable encryption none 1.8 SSH Strong Algorithm - b) Disable encryption 3des-cbc 1.8 SSH Strong Algorithm - c) Disable encryption aes128-cbc 1.8 SSH Strong Algorithm - d) Disable encryption aes192-cbc 1.8 SSH Strong Algorithm - e) Disable encryption aes256-cbc 1.8 SSH Strong Algorithm - f) Disable encryption blowfish-cbc 1.8 SSH Strong Algorithm - g) Disable hmac md5 1.8 SSH Strong Algorithm - h) Disable hmac none 1.8 SSH Strong Algorithm - i) Disable diffie-hellman group-exchange-sha1 1.8 SSH Strong Algorithm - j) Disable diffie-hellman group1-sha1 1.8 SSH Strong Algorithm - k) Disable hmac sha1 1.9 SSL Strong Algorithm - a) Version 1.9 SSL Strong Algorithm - b) ciphersuite 1.9 SSL Strong Algorithm - c) pki-profile 1.9 SSL Strong Algorithm - d) renegotiate 2.1 Protection Policy for the CPS Control Engine 2.2 NTP Security Protection - a) Enable NTP 2.2 NTP Security Protection - b) NTP access-group 2.2 NTP Security Protection - c) NTP Auth-key encrypted 2.3 Disable the Proxy ARP Function - a) No proxy 2.3 Disable the Proxy ARP Function - b) No inter-vlan-proxy 2.3 Disable the Proxy ARP Function - c) No proxy local 2.3 Disable the Proxy ARP Function - d) No local-proxy-arp 2.4 Disable the IP Unreachable Function 2.5 Product Default Banner 3.1 Authentication and Verification of OSPF Routing Protocols - authentication message-digest 3.1 Authentication and Verification of OSPF Routing Protocols - message-digest-key 3.2 Authentication and Verification of ISIS Routing Protocols - authentication 3.2 Authentication and Verification of ISIS Routing Protocols - authentication-type hmac-md5 3.3 Authentication and Verification of BGP Routing Protocols