Skip to content

Commit e2d7d8c

Browse files
netpickernetpicker
authored
Merge pull request #16 from netpicker/netpicker-adding-linting
Netpicker adding linting
2 parents 6af8427 + 4543afc commit e2d7d8c

20 files changed

+116
-142
lines changed

‎CIS/Cisco_ios/11_local_authentication_authorization_and_accounting_rules/rule_1110_set_aaa_accounting_system.py

Lines changed: 2 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,8 @@
11
from comfy.compliance import low
22

3-
43
@low(
54
name='rule_1110_set_aaa_accounting_system',
65
platform=['cisco_ios', 'cisco_xe']
76
)
8-
def rule_1110_set_aaa_accounting_system(configuration):
9-
uri = (
10-
"http://www.cisco.com/en/US/docs/ios-xml/ios/security/a1/sec-cr-a1.html#GUID-0520BCEF-89FB-45"
11-
"05-A5DF-D7F1389F1BBA"
12-
)
13-
14-
remediation = (f"""
15-
Remediation: hostname(config)#aaa accounting system [[default | list-name | guarantee -
16-
first] [start-stop | stop-only | none] [radius | group group-name]
17-
18-
References: {uri}
19-
20-
""")
21-
22-
assert 'aaa accounting system' in configuration, remediation
7+
def rule_1110_set_aaa_accounting_system(configuration,ref):
8+
assert 'aaa accounting system' in configuration, ref

‎CIS/Cisco_ios/11_local_authentication_authorization_and_accounting_rules/rule_1110_set_aaa_accounting_system.ref

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
.rule_1110_set_aaa_accounting_system:
2+
3+
4+
Reference: 1. http://www.cisco.com/en/US/docs/ios-xml/ios/security/a1/sec-cr-a1.html#GUID-0520BCEF-89FB-4505-A5DF-D7F1389F1BBA Additional Information: When system accounting is used and the accounting server is unreachable at system startup time, the system will not be accessible for approximately two minutes.
5+
6+
7+
Remediation: Configure AAA accounting system. hostname(config)#aaa accounting system {default | list-name | guarantee- first} {start-stop | stop-only | none} {radius | group group-name}
8+
9+
.

‎CIS/Cisco_ios/11_local_authentication_authorization_and_accounting_rules/rule_111_enable_aaa_new_model.py

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
from comfy.compliance import *
1+
from comfy.compliance import medium
22

33
@medium(
4-
name='rule_111_enable_aaa_new_model',
5-
platform=['cisco_ios', 'cisco_xe']
4+
name='rule_111_enable_aaa_new_model',
5+
platform=['cisco_ios', 'cisco_xe']
66
)
7-
def rule_111_enable_aaa_new_model(configuration, ref):
7+
def rule_111_enable_aaa_new_model(configuration,ref):
88
assert 'no aaa new-model' not in configuration, ref

‎CIS/Cisco_ios/11_local_authentication_authorization_and_accounting_rules/rule_111_enable_aaa_new_model.ref

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
.rule_111_enable_aaa_new_model:
2-
Reference: http://www.cisco.com/en/US/docs/ios-xml/ios/security/a1/sec-cr-a2.html#GUID-E05C2E00-C01E-4053-9D12-EC37C7E8EEC5
32

4-
Remediation: hostname(config)#aaa new-model
3+
4+
Reference: 1. http://www.cisco.com/en/US/docs/ios-xml/ios/security/a1/sec-cr-a2.html#GUID-E05C2E00-C01E-4053-9D12-EC37C7E8EEC5
5+
6+
7+
Remediation: Globally enable authentication, authorization and accounting (AAA) using the new- model command. hostname(config)#aaa new-model
8+
59
.

‎CIS/Cisco_ios/11_local_authentication_authorization_and_accounting_rules/rule_112_enable_aaa_authentication_login.py

Lines changed: 4 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -2,21 +2,9 @@
22

33

44
@medium(
5-
name='rule_112_enable_aaa_authentication_login',
6-
platform=['cisco_ios', 'cisco_xe']
5+
name='rule_112_enable_aaa_authentication_login',
6+
platform=['cisco_ios', 'cisco_xe']
77
)
8-
def rule_112_enable_aaa_authentication_login(configuration):
9-
uri = (
10-
"http://www.cisco.com/en/US/docs/ios-xml/ios/security/a1/sec-cr-a1.html#GUID-3DB1CC8A-4A98-40"
11-
"0B-A906-C42F265C7EA2"
12-
)
138

14-
remediation = (f"""
15-
Remediation: hostname(config)#aaa authentication login {{default | aaa_list_name}} [passwd -
16-
expiry] [method1] [method2]
17-
18-
References: {uri}
19-
20-
""")
21-
22-
assert 'aaa authentication login' in configuration, remediation
9+
def rule_112_enable_aaa_authentication_login(configuration,ref):
10+
assert 'aaa authentication login' in configuration, ref

‎CIS/Cisco_ios/11_local_authentication_authorization_and_accounting_rules/rule_112_enable_aaa_authentication_login.ref

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
.rule_112_enable_aaa_authentication_login:
2+
3+
4+
Reference: 1. http://www.cisco.com/en/US/docs/ios-xml/ios/security/a1/sec-cr-a1.html#GUID-3DB1CC8A-4A98-400B-A906-C42F265C7EA2 Additional Information: Only “the default method list is automatically applied to all interfaces except those that have a named method list explicitly defined. A defined method list overrides the default method list.” (1)
5+
6+
7+
Remediation: Configure AAA authentication method(s) for login authentication. hostname(config)#aaa authentication login {default | aaa_list_name} [passwd- expiry] [method1] [method2]
8+
9+
.

‎CIS/Cisco_ios/11_local_authentication_authorization_and_accounting_rules/rule_113_enable_aaa_authentication_enable_default.py

Lines changed: 2 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,8 @@
11
from comfy.compliance import medium
22

3-
43
@medium(
54
name='rule_113_enable_aaa_authentication_enable_default',
65
platform=['cisco_ios', 'cisco_xe']
76
)
8-
def rule_113_enable_aaa_authentication_enable_default(configuration):
9-
uri = (
10-
"http://www.cisco.com/en/US/docs/ios-xml/ios/security/a1/sec-cr-a1.html#GUID-4171D649-2973-47"
11-
"07-95F3-9D96971893D0"
12-
)
13-
14-
remediation = (f"""
15-
Remediation: hostname(config)#aaa authentication enable default {{method1}} enable
16-
17-
References: {uri}
18-
19-
""")
20-
21-
assert 'aaa authentication enable' in configuration, remediation
7+
def rule_113_enable_aaa_authentication_enable_default(configuration,ref):
8+
assert 'aaa authentication enable' in configuration, ref

‎CIS/Cisco_ios/11_local_authentication_authorization_and_accounting_rules/rule_113_enable_aaa_authentication_enable_default.ref

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
.rule_113_enable_aaa_authentication_enable_default:
2+
3+
4+
Reference: 1. http://www.cisco.com/en/US/docs/ios-xml/ios/security/a1/sec-cr-a1.html#GUID-4171D649-2973-4707-95F3-9D96971893D0
5+
6+
7+
Remediation: Configure AAA authentication method(s) for enable authentication. hostname(config)#aaa authentication enable default {method1} enable
8+
9+
.

‎CIS/Cisco_ios/11_local_authentication_authorization_and_accounting_rules/rule_114_set_login_authentication_for_line_vty_ted.py

Lines changed: 7 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,9 @@
1+
from comfy.compliance import medium
2+
13
@medium(
2-
name='rule_114_set_login_authentication_for_line_vty_ted',
3-
platform=['cisco_ios', 'cisco_xe'],
4-
commands=dict(chk_con='show running-config | sec line con',chk_vty='show running-config | sec line vty')
4+
name='rule_114_set_login_authentication_for_line_vty_ted',
5+
platform=['cisco_ios', 'cisco_xe'],
6+
commands=dict(chk_cmd='show running-config | sec line | incl login authentication')
57
)
6-
def rule_114_set_login_authentication_for_line_vty_ted(commands):
7-
uri = (
8-
"http://www.cisco.com/en/US/docs/ios-xml/ios/security/d1/sec-cr-k1.html#GUID-297BDF33-4841-44"
9-
"1C-83F3-4DA51C3C7284"
10-
)
11-
12-
remediation = (f"""
13-
Remediation: hostname(config-line)#login authentication {{default | aaa_list_name}}
14-
15-
References: {uri}
16-
17-
""")
18-
assert 'login authentication' in commands.chk_con, remediation
19-
assert 'login authentication' in commands.chk_vty, remediation
8+
def rule_114_set_login_authentication_for_line_vty_ted(commands,ref):
9+
assert ' login authentication' in commands.chk_cmd, ref

‎CIS/Cisco_ios/11_local_authentication_authorization_and_accounting_rules/rule_114_set_login_authentication_for_line_vty_ted.ref

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
.rule_114_set_login_authentication_for_line_vty:
2+
3+
4+
Reference: 1. http://www.cisco.com/en/US/docs/ios-xml/ios/security/d1/sec-cr-k1.html#GUID-297BDF33-4841-441C-83F3-4DA51C3C7284
5+
6+
7+
Remediation: Configure management lines to require login using the default or a named AAA authentication list. This configuration must be set individually for all line types. hostname(config)#line vty {line-number} [<em>ending-line-number] hostname(config-line)#login authentication {default | aaa_list_name}
8+
9+
.

0 commit comments

Comments
 (0)