OpenControls Logo

STIG Viewer

STIGViewer Support

The HPE 3PAR OS must be configured for centralized account management functions via LDAP.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-255278HP3P-33-001500SV-255278r958362_ruleCCI-000015medium
Description
Enterprise environments make account management challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other errors. A comprehensive account management process that includes automation helps to ensure accounts designated as requiring attention are consistently and promptly addressed. Examples include, but are not limited to, using automation to take action on multiple accounts designated as inactive, suspended or terminated, or by disabling accounts located in noncentralized account stores such as multiple servers. This requirement applies to all account types, including individual/user, shared, group, system, guest/anonymous, emergency, developer/manufacturer/vendor, temporary, and service. The automated mechanisms may reside within the operating system itself or may be offered by other infrastructure providing automated account management capabilities. Automated mechanisms may be composed of differing technologies that, when placed together, contain an overall automated mechanism supporting an organization's automated account management requirements. Account management functions include assigning group or role membership; identifying account type; specifying user access authorizations (i.e., privileges); account removal, update, or termination; and administrative alerts. The use of automated mechanisms can include, for example, using email or text messaging to automatically notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using automated telephonic notification to report atypical system account usage. The HPE 3PAR OS supports external account management via communication with LDAP-enabled technologies (OpenLDAP and Active Directory). Configuration is required to establish the external management relationship. Internally defined roles (SUPER, SERVICE, EDIT, BROWSE) are mapped to centrally defined user groups. Administrators attempting to log in are checked first against local accounts (for emergency purposes). If no local account exists, the central account management system is checked. Users that are successfully authenticated, are then checked for membership in the mapped groups to establish their authorization to access the system, if any, and at what role level. Satisfies: SRG-OS-000001-GPOS-00001, SRG-OS-000104-GPOS-00051, SRG-OS-000042-GPOS-00021
STIGDate
HPE 3PAR StoreServ 3.3.x Security Technical Implementation Guide2024-08-27

Related Frameworks

3 mappings across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (7) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-01.2Authenticate, Authorize and Audit (AAA)
1.00
IAC-02Identification & Authentication for Organizational Users
1.00
IAC-03Identification & Authentication for Non-Organizational Users
1.00
IAC-04Identification & Authentication for Devices
1.00
IAC-05Identification & Authentication for Third-Party Technology Assets, Applications and/or Services (TAAS)
1.00
IAC-15.1Automated System Account Management (Directory Services)
0.50
MON-03.1Sensitive Event Log Information
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (100) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control
1.00
AC-11Device Lock
1.00
AC-12Session Termination
1.00
AC-16Security and Privacy Attributes
1.00
AC-17(1)Monitoring and Control
1.00
AC-17(10)Authenticate Remote Commands
1.00
AC-17(9)Disconnect or Disable Access
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(11)Usage Conditions
1.00

+90 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (4) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.3.1
1.00
3.3.2
1.00
3.5.1
1.00
3.5.2
1.00
CCI3 mappings
CCI-000015
1.00
CCI-000135
1.00
CCI-000764
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.AA-01
1.00
PR.AA-03
1.00
PR.AA-05
1.00

Who does this work

7 NICE work roles and 5 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-255278r958362_chk)

Determine if the system is configured for external account management. Enter the command "cli% showauthparam" If the result returns an error, or these fields of the output are not configured, this is a finding. ldap-server <ip address of LDAP server> ldap-server-hn <host name of LDAP server> ldap-type <RHDS | OPEN> If ldap-type is "MSAD", this requirement is not applicable. If the resulting Parameters DO NOT include the following group parameters, this is a finding. groups-dn group-obj group-name-attr Next, verify that the LDAP authentication is operational by entering the command: cli% checkpassword <username> Enter the password for <username> If the username and password used in checkpassword are known to be valid LDAP credentials, and the following text is NOT displayed at the end of the resulting output, this is a finding. user <username> is authenticated and authorized Note: checkpassword will fail even if LDAP is properly configured, if the username and password are not entered correctly.

Fix Text (F-58895r870152_fix)

If Active Directory is in use, this requirement is not applicable. Use this series of commands to configure LDAP: cli% setauthparam -f ldap-type <type> where type is RHDS or OPEN. cli% setauthparam -f ldap-server        <ldap server IP address> cli% setauthparam -f ldap-server-hn    <fully qualified domain name of ldap server, such as ldapserver.thisdomain.com> cli% setauthparam -f binding            simple cli% setauthparam -f ldap-StartTLS      require cli% setauthparam -f groups-dn          ou=Groups,dc=thisdomain,dc=com cli% setauthparam -f user-dn-base       ou=People,dc=thisdomain,dc=com cli% setauthparam -f user-attr          uid cli% setauthparam -f group-obj          groupofuniquenames cli% setauthparam -f group-name-attr    cn cli% setauthparam -f member-attr        uniqueMember cli% setauthparam -f browse-map <customer-assigned name of browse role> <customer-assigned name of "browse" group> cli% setauthparam -f edit-map          <customer-assigned name of edit role> <customer-assigned name of "edit" group> cli% setauthparam -f service-map      <customer-assigned name of service role> <customer-assigned name of "service" group> cli% setauthparam -f super-map          <customer-assigned name of super role> <customer-assigned name of "super" group>