OpenControls Logo

STIG Viewer

STIGViewer Support

The Palo Alto Networks security platform must employ centrally managed authentication server(s).

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-228673PANW-NM-000136SV-228673r1082978_ruleCCI-000366medium
Description
The use of authentication servers or other centralized management servers for providing centralized authentication services is required for network device management. Maintaining local administrator accounts for daily usage on each network device without centralized management is not scalable or feasible. Without centralized management, it is likely that credentials for some network devices will be forgotten, leading to delays in administration, which itself leads to delays in remediating production problems and in addressing compromises in a timely fashion. Only the emergency administration account, also known as the account of last resort, can be locally configured on the device.
STIGDate
Palo Alto Networks NDM Security Technical Implementation Guide2025-03-12

Related Frameworks

2 mappings across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (9) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CFG-01Configuration Management Program
1.00
END-01Endpoint Device Management (EDM)
1.00
END-04Malicious Code Protection (Anti-Malware)
1.00
END-06Endpoint File Integrity Monitoring (FIM)
1.00
MON-01Continuous Monitoring
1.00
MON-01.7File Integrity Monitoring (FIM)
1.00
CFG-02Secure Baseline Configurations
0.50
CFG-02.2Automated Central Management & Verification
0.50
CFG-02.7Approved Configuration Deviations
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (100) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-12Session Termination
1.00
AC-16(1)Dynamic Attribute Association
1.00
AC-17(1)Monitoring and Control
1.00
AC-2Account Management
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-24(1)Transmit Access Authorization Information
1.00
AC-25Reference Monitor
1.00

+90 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.4.1
1.00
3.4.2
1.00
CCI2 mappings
CCI-000366
1.00
CCI-000372
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (5) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

DE.CM-09
1.00
PR.PS-01
1.00
PR.DS-10
0.50
PR.PSPlatform Security
0.50
PR.PS-05
0.50

Who does this work

10 NICE work roles and 9 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-228673r1082978_chk)

Ask the administrator which form of centralized authentication server is being used. This requirement is not applicable to the local account of last resort. Navigate to the appropriate window to view the configured server(s). For RADIUS, go to Device >> Server Profiles >> RADIUS. For LDAP, go to Device >> Server Profiles >> LDAP. For Kerberos, go to Device >> Server Profiles >> Kerberos. If there are no servers configured in the window that match the specified form of centralized authentication, this is a finding.

Fix Text (F-30885r1082978_fix)

The device allows three different authentication protocols: RADIUS, LDAP, and Kerberos. In this explanation, LDAP is used. To configure the Palo Alto Networks security platform to use an LDAP server, follow these steps: 1. Go to Device >> Server-Profiles >> LDAP. 2. Select "Add" (lower left of window). 3. Populate the required fields. a. Enter the name of the profile in the "Name" field. b. In the server box enter the name of the server in the "Name" field. c. Enter the IP Address of the server. d. Enter the Port number the firewall should use to connect to the LDAP server (default=389 for LDAP; 636 for LDAP over SSL). e. Enter the LDAP Domain name to prepend to all objects learned from the server. The value entered here depends on the specific deployment. If using Active Directory, enter the NetBIOS domain name; not an FQDN (for example, enter acme, not acme.com). Note that if collecting data from multiple domains, it is necessary to create separate server profiles. If using a global catalog server, leave this field blank. 4. Select the Type of LDAP server that will be connected. The correct LDAP attributes in the group mapping settings will automatically be populated based on the selection. 5. In the Base field, select the DN that corresponds to the point in the LDAP tree where the firewall is to begin its search for user and group information. 6. Select the SSL checkbox. 7. Select "OK". To create an Authentication Profile using the newly created LDAP server, follow these steps: 1. Go to Device >> Authentication Profile. 2. Select "Add" (lower left of window). 3. Populate the required fields as needed. a. In the Authentication field, select "LDAP". b. In the Server Profile field, select the configured LDAP server profile. c. In the Login Attribute field, enter “sAMAccountName”. 4. Select "OK". Apply the authentication profile to the Administrator accounts. 1. Go to Device >> Administrators. 2. Select each configured account or select "Add" (in the bottom-left corner of the pane) to create a new one. 3. In the "Authentication Profile" field, enter the configured LDAP authentication profile. 4. Select "OK". Note: The name of the administrator must match the name of the user in the LDAP server. Note: The authentication profile must not be applied to the emergency administration account since it has special requirements. Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears. Note that the emergency administration account is the only account that is configured locally on the device itself.