1.4.3.3 Ensure 'aaa authentication secure-http-client' is configured correctly

Information

Provides a secure method, SSL, to protect username and password to be sent in clear text

Rationale:

If HTTP authentication is used without the command aaa authentication secure-http-client, the username and password are sent from the client to the security appliance in clear text.

Solution

Configure the secure aaa authentication for http

hostname(CONFIG)#AAA AUTHENTICATION SECURE-HTTP-CLIENT

See Also

https://workbench.cisecurity.org/files/1903

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2(9), CSCv7|4.3

Plugin: Cisco

Control ID: 337af5695f3b37a7fdc02627c76949f7e721e11a72159921a03204379c30c3ca