DISA STIGS Viewer

AOS must authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.

Overview

Finding ID Version Rule ID IA Controls Severity
V-266976 ARBA-ND-000347 SV-266976r1039949_rule   Medium
Description
If NTP is not authenticated, an attacker can introduce a rogue NTP server. This rogue server can then be used to send incorrect time information to network devices, which will make log timestamps inaccurate and affect scheduled actions. NTP authentication is used to prevent this tampering by authenticating the time source.
STIG Date
HPE Aruba Networking AOS NDM Security Technical Implementation Guide 2024-10-29

Details

Check Text (C-70900r1039947_chk)
1. Verify the AOS configuration with the following command:
show ntp status

If "Authentication" shows "disabled", this is a finding.

2. show running-config | include ntp

If at least one trusted NTP authentication-key is not configured and at least one NTP server configured to use the key, this is a finding.
Fix Text (F-70803r1039948_fix)
Configure AOS with the following commands:
configure terminal
ntp authentication-key (keyid #> sha1 <plaintext key>
ntp trusted-key <keyid #>
ntp server <first fqdn, ipv4, or ipv6 address> key <keyid #>
ntp server <second fqdn, ipv4, or ipv6 address> key <keyid #>
ntp authenticate
write memory