-
User Guide for Cisco Security MARS Local Controller, Release 5.3.x
-
Preface
-
STM Task Flow Overview
-
Reporting and Mitigation Devices Overview
-
Authenticating with External AAA Servers
-
Configuring Router and Switch Devices
-
Configuring Firewall Devices
-
Configuring VPN Devices
-
Configuring Network-based IDS and IPS Devices
-
Configuring Host-Based IDS and IPS Devices
-
Configuring Antivirus Devices
-
Configuring Vulnerability Assessment Devices
-
Configuring Generic, Solaris, Linux, and Windows Application Hosts
-
Configuring Database Applications
-
Configuring Web Server Devices
-
Configuring Web Proxy Devices
-
Configuring AAA Devices
-
Configuring Wireless LAN Devices
-
Configuring Custom Devices
-
Policy Table Lookup on Cisco Security Manager
-
Network Summary
-
Case Management
-
Incident Investigation and Mitigation
-
Queries and Reports
-
Rules
-
Sending Alerts
-
Management Tab Overview
-
System Maintenance
-
Cisco Security MARS XML API Reference
-
Regular Expression Reference
-
Date/Time Format Specfication
-
System Rules and Reports Reference
-
Glossary
-
Index
-
Feedback
Table Of Contents
Authenticating MARS Accounts with External AAA Servers
Information About Authenticating MARS User Accounts with External AAA Servers
Supported AAA Protocols and Servers
Summary of MARS Appliance AAA Configuration Tasks
Summary of AAA Server Configuration Tasks
Global Controller Considerations with External AAA Servers
Failed Authentication Lockout (Login Failure)
System Events related to Authentication and Login Attempts
System Reports and Rules related to Authentication Method
Procedure for First-time Configuration of MARS AAA Feature
Procedure to Edit an External AAA Server
Procedure to Delete an External AAA Server
Procedure to Unlock an Account after Login Failure
Authenticating MARS Accounts with External AAA Servers
Revised: April 5, 2007External Authentication, Authorization, and Auditing (AAA) servers can act as the authentication mechanism for MARS Appliance GUI logins (username and password). This permits authentication and centralized password management for all MARS Appliances.
Feature History for MARS Appliance AAA Authentication Method
Contents
This chapter describes the Authentication, Authorization and Accounting (AAA) feature for the MARS Appliances and includes the following sections:
•
Information About Authenticating MARS User Accounts with External AAA Servers
•
Information About Authenticating MARS User Accounts with External AAA Servers
The administrator can configure MARS to authenticate GUI login attempts with an external AAA server, or with the default method of authenticating to the appliance's local database, as described in the following sections:
•
•
•
•
Supported AAA Protocols and Servers
The AAA protocol used by MARS is a basic Remote Authentication Dial In User Service (RADIUS) protocol. The supported external RADIUS servers are as follows:
•
•
•
Configuration Overview
The following overview describes the Local Controller. Global Controller differences are discussed in the later section, "Global Controller Considerations with External AAA Servers."
Summary of MARS Appliance AAA Configuration Tasks
1.
On each MARS Appliance to which a user must have access, the MARS administrator must create a user account for that user (contact information, group permissions and role). The account can be created on the Local Controller or on a Global Controller and pushed to the Local Controller.
2.
Each MARS Appliance must be individually configured to run the AAA authentication method. From the AAA Configuration page (Admin > System Setup > Authentication Configuration), manually add external AAA servers in a procedure similar to that of adding a software security application on a new host.
Up to three AAA servers can be selected for AAA server authentication. They are named the primary, secondary, and tertiary servers which signifies their rank in the AAA server failover sequence.
Note
When the MARS Appliance operates with the AAA authentication method, every login except the administrator accounts are authenticated by the external AAA server.
All authentication method changes, successful logins, and failed logins are captured as event messages.
Summary of AAA Server Configuration Tasks
1.
2.
See the user guide of your AAA server for details.
Global Controller Considerations with External AAA Servers
The following constraints and recommendations pertain to using the AAA authentication method with a Global Controller:
•
Using the Local authentication method, a user can have two accounts with the same login name and different passwords on a single appliance, for example, global:person1 created on the Global Controller and pushed to the Local Controller and local:person1 created on the Local Controller. Because the AAA server has only one password per login name, do the following to maintain the Local method functionality with the AAA method:
–
–
•
Configuring AAA Authentication Method on a Global Controller is similar to configuring AAA on a Local Controller, except that AAA servers cannot be added, edited or deleted on a Global Controller. The list of available AAA server names in the GUI is populated from the Local Controllers reporting to the Global Controller. The hostname of the reporting Local Controller is prepended to the AAA server name. The Global Controller should use an AAA server from the closest Local Controller on the network.
•
To avoid login problems, the optimal scenario is to have all Local Controller and Global Controllers use the same authentication method, either all Local or all AAA. For example, when a Global Controller uses AAA method, and a Local Controller uses Local method, any global user accounts pushed to the Local Controller will not have passwords. Any login attempt by the global user to that Local Controller fails until the administrator configures a password for the global account.
•
When a Global Controller and a Local Controller use different AAA servers for authentication the Global Controller login name and password must be configured in one of the Local Controller's AAA servers or the Global Controller user will not be able to login to the Local Controller.
•
If a Local Controller deletes the AAA server in use by a Global Controller, the Global Controller is automatically switched to Local authentication. To reestablish AAA authentication for the Global Controller, the administrator must reconfigure the Global Controller to AAA authentication method and select another AAA server.
Just prior to a Local Controller being deleted from a Global Controller, a warning message appears if it is the Local Controller with the AAA server to which the Global Controller authenticates.
•
Unlocking is not replicated through Global Controller-Local Controller communications, it applies only to the local appliance. An account locked on a Global Controller does not replicate the locked status to global accounts on Local Controllers. A global account locked on two different appliances must be unlocked manually on each appliance.
Failed Authentication Lockout (Login Failure)
For both Local or AAA authentication methods, GUI access is prevented (locked) for an account upon login failure, which occurs when a specified number of incorrect password entries are made for a single login name.
The maximum number of password attempts before locking is set by the Maximum Login Failures parameter in the Account Lockout Policy box of the AAA configuration page
(Admin > System Setup > Authentication Configuration). The default setting is 5 attempts. By setting the Account Lockout Policy to Never Lock, the administrator can disable GUI locking for all accounts, but not specific accounts.The count of incorrect attempts before login failure clears only when a successful login occurs, it does not age out. For example, if a user performs two incorrect password attempts then quits for the day, they must succeed on the first attempt the next morning or the account will be locked. A running session does not terminate if a login failure occurs for the same user account attempting to open another session, but the account will be locked to all future login attempts.
Once locked, an account must be unlocked by the MARS administrator.
The Admin > User Management page of the GUI displays locked accounts. The Status column indicates if the account is active, locked or password expired. An administrator can unlock accounts from the User Management page by selecting the accounts and clicking Unlock.
Note
The CLI access through the console or through SSH is never locked. The unlock CLI command can unlock GUI access for some or all accounts. This is the recourse when the administrator is locked out from the GUI. For information on the unlock command, see the Command Reference chapter in the Install and Setup Guide for Cisco Security MARS, at the following URL:
System Events related to Authentication and Login Attempts
Table 3-1 lists events triggered by Local and AAA authentication method actions.
System Reports and Rules related to Authentication Method
For descriptions of MARS reports and rules, please see the "Systems Rule and Reports Reference" at following URL:
System Reports
The following six reports disclose authentication events. All the reports are custom column,
run on-demand only, with a time range of 1 day.•
•
•
•
•
•
System Rules
The following three rules capture authentication method configuration actions:
•
•
•
The following system rule is triggered depending on how events are grouped:
•
Because MARS login successes and failures are grouped into event groups the following rules could fire if a MARS Local Controller is also the target of attacks described in each of the following rules:
•
•
•
•
•
Login events groups—Info/SuccessfulLogin/System/Root, Info/SuccessfulLogin/System/Non-root, Penetrate/GuessPassword/System/Root and Penetrate/GuessPassword/System/Non-root
Procedure for First-time Configuration of MARS AAA Feature
This procedure demonstrates a first-time configuration of AAA Authentication method for a
MARS Appliance.Summary of steps:
1.
2.
3.
Prerequisites
The following prerequisites are required to configure the AAA authentication method:
•
•
Tip
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.1/user/WebIntr.html#wp417167•
Note
•
–
–
–
–
–
Step 1
Figure 3-1 Admin > System Setup Page
Step 2
If you are configuring a Global Controller, please skip to Step 9.
Figure 3-2 AAA Configuration Page
Add an external AAA Server
Step 3
Figure 3-3 Add Reporting Device Page
Step 4
The usage guidelines for the configuration fields are equivalent to those for adding a monitoring device.
Note
Figure 3-4 Reporting Application Dialog
Select Generic AAA Server and then click Add.
The AAA Server Configuration pop-up window appears, as shown in Figure 3-5.
Figure 3-5 AAA Server Configuration Pop-up Window
Step 5
The default authentication and authorization port is 1812.
The default accounting port is 1813.
Step 6
A pop-up window appears for success or failure, as shown in Figure 3-6 and Figure 3-7.
Note
Figure 3-6 Connectivity Succeeds Pop-up Window
Figure 3-7 Connectivity Fails Pop-up Window
Step 7
You are returned to the AAA Configuration Page, as shown in Figure 3-2.
If the connectivity fails, you are returned to the AAA Server Configuration Pop-up Window, as shown in Figure 3-5. Troubleshoot the AAA server connection until connectivity succeeds.
Step 8
Select AAA Authentication
Step 9
If you are configuring a Global Controller, select the AAA server closest to the Global Controller.
Figure 3-8 Select Newly-added AAA Server From Drop-down List
Configure Account Lockout Policy (optional)
In the Account Lockout Policy box, configure the maximum login failures threshold, or click the Never Lock radio button.
Figure 3-9 Maximum Login Failure Parameter
Step 10
When the authentication method is changed from Local to AAA Server, all user passwords are removed from the MARS local database (except administrators). If you change the authentication method back to Local from AAA Server, you must reconfigure all the user passwords with the MARS GUI
(Management > User Management).When the MARS authentication is set to AAA server mode, user passwords can not be added or edited on the MARS User Management page.
End of Procedure for First-time Configuration of MARS AAA Feature.
Procedure to Edit an External AAA Server
Step 1
Step 2
Step 3
Step 4
Figure 3-10 Edit Server Page
Step 5
Step 6
Step 7
You are returned to the AAA Configuration Page, as shown in Figure 3-2.
If the connectivity fails, you are returned to the AAA Server Configuration Pop-up Window, as shown in Figure 3-5. Troubleshoot the AAA server connection until connectivity succeeds.
Step 8
End of Procedure to Edit an External AAA Server.
Procedure to Delete an External AAA Server
Step 1
Step 2
Step 3
Step 4
Figure 3-11 Server Delete Confirmation
Step 5
If the AAA server deleted is a primary server used by a Global Controller, The Global Controller automatically switches to the Local authentication method and the administrator must reconfigure the Global Controller to AAA method and select another AAA server as required.
End of Procedure to Delete an External AAA Server.
Procedure to Unlock an Account after Login Failure
The following procedure details the steps required to unlock a non-administrative Local Controller or Global Controller account. To unlock an administrative account, use the unlock CLI command, as described at the following URL:
A login failure to the MARS GUI is signaled by the Login Failure message, as shown in Figure 3-12.
Figure 3-12 Login Failure Message
Step 1
Step 2
The status column indicates which accounts are locked.
Click the checkbox of the user accounts to unlock.
Figure 3-13 Unlocking a Locked User Account
Step 3
End of Procedure to Unlock an Account after Login Failure.
