AMLS-NM-000420 - The Arista Multilayer Switch must protect the audit records of nonlocal accesses to privileged accounts and the execution of privileged functions - trap logging

Information

Auditing may not be reliable when performed by the network device to which the user being audited has privileged access. The privileged user may inhibit auditing or modify audit records. This control enhancement helps mitigate this risk by requiring that privileged access be further defined between audit-related privileges and other privileges, thus limiting the users with audit-related privileges. Reducing the risk of audit compromises by privileged users can also be achieved by performing audit activity on a separate information system or by using storage media that cannot be modified (e.g., write-once recording devices).

Solution

Configure the system to protect the audit records of nonlocal accesses to privileged accounts and the execution of privileged functions.

Enable remote logging with:

config
logging host a.b.c.d
logging trap informational

To assign a user to a role, use the command:

username [name] role [role name]

To deny access to logging functions via RBAC:

role [name]
deny command logging [all]

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Arista_MLS_DCS-7000_Series_Y24M07_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-217375r961863_rule, STIG-ID|AMLS-NM-000420, STIG-Legacy|SV-75341, STIG-Legacy|V-60883, Vuln-ID|V-217375

Plugin: Arista

Control ID: e9360e8b5bb063409d81247add891d85669abc338eef9d95e5b82f2de8751121