Rule ID
SV-255951r960777_rule
Version
V2R2
This requirement supports non-repudiation of actions taken by an administrator and is required in order to maintain the integrity of the configuration management process. All configuration changes to the network device are logged, and administrators authenticate with two-factor authentication before gaining administrative access. Together, these processes will ensure the administrators can be held accountable for the configuration changes they implement. Satisfies: SRG-APP-000026-NDM-000208, SRG-APP-000027-NDM-000209, SRG-APP-000028-NDM-000210, SRG-APP-000029-NDM-000211, SRG-APP-000080-NDM-000220, SRG-APP-000091-NDM-000223, SRG-APP-000101-NDM-000231, SRG-APP-000319-NDM-000283, SRG-APP-000343-NDM-000289, SRG-APP-000495-NDM-000318, SRG-APP-000499-NDM-000319, SRG-APP-000503-NDM-000320, SRG-APP-000504-NDM-000321, SRG-APP-000506-NDM-000323
Verify the Arista network device is configured to audit all administrator activity. Verify the AAA logging settings in the configuration file with the following example: switch#show running-config | section aaa aaa authentication policy on-success log aaa authentication policy on-failure log aaa accounting exec default start-stop group radius logging aaa accounting system default start-stop group radius logging aaa accounting commands all default start-stop logging group radius If the Arista network device is not configured to audit all administrator activity, this is a finding.
Configure the Arista network device to audit all administrator activity. Configure the AAA settings to capture administrator activity events. switch(config)#aaa authentication policy on-success log switch(config)#aaa authentication policy on-failure log switch(config)#aaa accounting exec default start-stop group radius logging switch(config)#aaa accounting system default start-stop group radius logging switch(config)#aaa accounting commands all default start-stop logging group radius