AOS must authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-266976 | ARBA-ND-000347 | SV-266976r1039949_rule | CCI-001967 | medium |
| Description | ||||
| If NTP is not authenticated, an attacker can introduce a rogue NTP server. This rogue server can then be used to send incorrect time information to network devices, which will make log timestamps inaccurate and affect scheduled actions. NTP authentication is used to prevent this tampering by authenticating the time source. | ||||
| STIG | Date | |||
| HPE Aruba Networking AOS NDM Security Technical Implementation Guide | 2024-10-29 | |||
Details
Check Text (C-266976r1039949_chk)
1. Verify the AOS configuration with the following command:
show ntp status
If "Authentication" shows "disabled", this is a finding.
2. show running-config | include ntp
If at least one trusted NTP authentication-key is not configured and at least one NTP server configured to use the key, this is a finding.
Fix Text (F-70803r1039948_fix)
Configure AOS with the following commands:
configure terminal
ntp authentication-key (keyid #> sha1 <plaintext key>
ntp trusted-key <keyid #>
ntp server <first fqdn, ipv4, or ipv6 address> key <keyid #>
ntp server <second fqdn, ipv4, or ipv6 address> key <keyid #>
ntp authenticate
write memory