Recently Viewed Topics
Cisco IOS Keywords
The following table indicates how each keyword in the Cisco compliance checks can be used:
Keyword |
Example Use and Supported Settings |
---|---|
type |
CONFIG_CHECK, CONFIG_CHECK_NOT and RANDOMNESS_CHECK “CONFIG_CHECK” determines if the specified item exists in the CISCO IOS “show config” output. In the same manner, “CONFIG_CHECK_NOT” determines if the specified item does not exist. “RANDOMNESS_CHECK” is used to perform string complexity checks (e.g., password checks). If you specify an item to look for (via a regex), it will tell you if the string is “random” enough (at least eight characters long, with upper case, lower case, at least a digit and at least one special character). Note: The randomness parameters are currently not configurable. |
description |
The “description” keyword provides the ability to add a brief description of the check that is being performed. It is strongly recommended that the description field be unique and that no distinct checks have the same description field. Tenable SecurityCenter uses this field to automatically generate a unique plugin ID number based on the description field. Example: description: "Forbid Remote Startup Configuration" |
feature_set |
The “ Example: <item> type: CONFIG_CHECK description: "Version Check" info: "SSH Access Control Check." feature_set: "K8" context:"line .*" item: "access-class [0-9]+ in" </item> The check above will only run the “item” check if the Feature Set version matches the specified regex: (K8) In the event of a Feature Set version check failure, an error similar to the one below is displayed: "Version Check" : [SKIPPED] Test defined for 12.[5-9] whereas we are running 12.4(15)T10 |
info |
The “ Note: Each “ Example: info: "Verify at least one local user exists and ensure" info: "all locally defined user passwords are protected" info: "by encryption." |
item |
The “ Example: item: "transport input ssh" Regular expressions can be used within this keyword to filter the results of the match. Please see the |
regex |
The “ Example: regex: "snmp-server community ([^ ]*) .*" The following meta-characters require special treatment: + \ * ( ) ^ Escape these characters out twice with two backslashes “\\” or enclose them in square brackets “[]” if you wish for them to be interpreted literally. Other characters such as the following need only a single backslash to be interpreted literally: . ? " ' This has to do with the way that the compiler treats these characters. |
min_occurrences |
The “ Example: min_occurrences: "3" |
max_occurrences |
The “ Example: max_occurrences: "1" |
required |
The “ Example: required: NO |
context |
The “ line con 0 no modem enable line aux 0 access-class 42 in exec-timeout 10 0 no exec line vty 0 4 exec-timeout 2 0 password 7 15010X1C142222362G transport input ssh If you want to test a value from a particular serial line, using the context: "con 0" You will only grep on the following configuration item: line con 0 no modem enable Regular expressions can be used within this keyword to filter the results of the match. Please see the |