ARST-ND-000150 - The Arista network device must be configured to audit all administrator activity.

Information

This requirement supports non-repudiation of actions taken by an administrator and is required in order to maintain the integrity of the configuration management process. All configuration changes to the network device are logged, and administrators authenticate with two-factor authentication before gaining administrative access. Together, these processes will ensure the administrators can be held accountable for the configuration changes they implement.

Satisfies: SRG-APP-000026-NDM-000208, SRG-APP-000027-NDM-000209, SRG-APP-000028-NDM-000210, SRG-APP-000029-NDM-000211, SRG-APP-000080-NDM-000220, SRG-APP-000091-NDM-000223, SRG-APP-000101-NDM-000231, SRG-APP-000319-NDM-000283, SRG-APP-000343-NDM-000289, SRG-APP-000495-NDM-000318, SRG-APP-000499-NDM-000319, SRG-APP-000503-NDM-000320, SRG-APP-000504-NDM-000321, SRG-APP-000506-NDM-000323

Solution

Configure the Arista network device to audit all administrator activity.

Configure the AAA settings to capture administrator activity events.

switch(config)#aaa authentication policy on-success log
switch(config)#aaa authentication policy on-failure log
switch(config)#aaa accounting exec default start-stop group radius logging
switch(config)#aaa accounting system default start-stop group radius logging
switch(config)#aaa accounting commands all default start-stop logging group radius

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Arista_MLS_EOS_4-2x_Y24M07_STIG.zip

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

References: 800-53|AC-2(4), 800-53|AC-6(9), 800-53|AU-3(1), 800-53|AU-10, 800-53|AU-12c., CAT|II, CCI|CCI-000018, CCI|CCI-000135, CCI|CCI-000166, CCI|CCI-000172, CCI|CCI-001403, CCI|CCI-001404, CCI|CCI-001405, CCI|CCI-002130, CCI|CCI-002234, Rule-ID|SV-255951r960777_rule, STIG-ID|ARST-ND-000150, Vuln-ID|V-255951

Plugin: Arista

Control ID: 9b403c58cdff90cbcc9194e6edc273730f8ca5429a5594c31145612ac617e84b