← Back to RUCKUS ICX NDM Security Technical Implementation Guide

V-273826

CAT II (Medium)

The RUCKUS ICX device must authenticate Network Time Protocol sources using authentication that is cryptographically based.

Rule ID

SV-273826r1110846_rule

STIG

RUCKUS ICX NDM Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-001967

Discussion

If Network Time Protocol (NTP) is not authenticated, an attacker can introduce a rogue NTP server. This rogue server can then be used to send incorrect time information to network devices, which will make log timestamps inaccurate and affect scheduled actions. NTP authentication is used to prevent this tampering by authenticating the time source.

Check Content

View NTP configuration:

SSH@ICX# show running-config | begin ntp

ntp
 disable authenticate md5
 authenticate
 authentication-key key-id 1 sha1 2 $VWlkRGkt
 server x.x.x.x key 1
 server y.y.y.y key 1

If the NTP servers are not configured for authentication that is cryptographically based, this is a finding.

Fix Text

Configure NTP for authentication using SHA1:

SSH@ICX(config)# ntp
SSH@ICX(config-ntp)# disable authenticate md5
SSH@ICX(config-ntp)# authenticate
SSH@ICX(config-ntp)# authentication-key key-id 1 sha1 [password]