← Back to HPE Aruba Networking AOS NDM Security Technical Implementation Guide

V-266976

CAT II (Medium)

AOS must authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.

Rule ID

SV-266976r1039949_rule

STIG

HPE Aruba Networking AOS NDM Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-001967

Discussion

If NTP is not authenticated, an attacker can introduce a rogue NTP server. This rogue server can then be used to send incorrect time information to network devices, which will make log timestamps inaccurate and affect scheduled actions. NTP authentication is used to prevent this tampering by authenticating the time source.

Check Content

1. Verify the AOS configuration with the following command: 
show ntp status 
 
If "Authentication" shows "disabled", this is a finding.  
 
2. show running-config | include ntp 
 
If at least one trusted NTP authentication-key is not configured and at least one NTP server configured to use the key, this is a finding.

Fix Text

Configure AOS with the following commands: 
configure terminal 
ntp authentication-key (keyid #> sha1 <plaintext key> 
ntp trusted-key <keyid #> 
ntp server <first fqdn, ipv4, or ipv6 address> key <keyid #> 
ntp server <second fqdn, ipv4, or ipv6 address> key <keyid #> 
ntp authenticate 
write memory