Local administrators configured with no password profile.-paloaltonetworks-panos
Vendor: paloaltonetworks
OS: panos
Description:
Indeni will alert if any of the local accounts does not have a password profile attached.
Remediation Steps:
It is ok to have two local Admin login accounts as a backup mechanism to access the management of the devices. Local accounts are recommended to have password profiles attached and help to keep the account active and up to date so that inactive ones gets expired naturally.
How does this work?
This alert uses the Palo Alto Networks API interface to parse through local admin accounts and alert the admin if any of the accounts is not meeting the requirements: password-complexity, password-profile, maximum two local accounts (authentication profile = none).
Why is this important?
Administrator accounts need to be controlled and provided the right and sufficient access to resources as necessary. Password profiles help to keep the account active and up to date so that inactive ones gets expired naturally.
Without Indeni how would you find this?
Login to the device’s web interface and click on “Device” -> “Administrators”.
panos-local-account
Failed to fetch the data: https://bitbucket.org/indeni/indeni-knowledge/src/master/parsers/src/panw/panos/panos-local-admin/panos-local-admin.ind.yaml
PanosLocalAdminRule
Failed to fetch the data: https://bitbucket.org/indeni/indeni-knowledge/src/master/rules/templatebased/paloaltonetworks/PanosLocalAdminRule.scala