The HP FlexFabric Switch must enforce access restrictions associated with changes to the system components.

An XCCDF Rule

Description

<VulnDiscussion>Changes to the hardware or software components of the HP FlexFabric Switch can have significant effects on the overall security of the network. Therefore, only qualified and authorized individuals should be allowed administrative access to the HP FlexFabric Switch for implementing any changes or upgrades. This requirement applies to updates of the application files, configuration, ACLs, and policy filters.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-80777r1_rule
Severity: Medium
References: CCI-000345 CCI-000366
Updated: about 1 year ago

Configure the HP FlexFabric Switch to enforce access restrictions associated with changes to the system components. 

Below is an example how to configure a user-role and assign it to a user:

Create the user role role1: 
[HP] role name role1

Configure rule 1 to permit the user role to access read commands of all features: 

[HP-role-role1] rule 1 permit read feature

Configure rule 2 to permit the user role to create VLANs and access commands in VLAN view: 

[HP-role-role1] rule 2 permit command system-view ; vlan *

Change the VLAN policy to permit the user role to configure only VLANs 10 to 20: 

[HP-role-role1] vlan policy deny
[HP-role-role1-vlanpolicy] permit vlan 10 to 20
[HP-role-role1-vlanpolicy] quit
[HP-role-role1] quit

Create a management local user named user1 and enter its view: 

[HP] local-user user1 class manage

Set a password for the user: 

[HP-luser-manage-user1] password simple xxxxxx

Set the service type to SSH: 

[HP-luser-manage-user1] service-type ssh

Assign role1 to the user: 

[HP-luser-manage-user1] authorization-attribute user-role role1

To make sure that the user has only the permissions of role1, remove the user from the default user role network-operator: 

[HP-luser-manage-user1] undo authorization-attribute user-role network-operator
[HP-luser-manage-user1] quit

The HP FlexFabric Switch must enforce access restrictions associated with changes to the system components.

Description

Remediation - Manual Procedure