Details

TFTP should not be used for file transfers as it does not require authentication, and transfers data in the clear, enabling an unauthorized user to intercept potentially sensitive data. Secure File Transfer Protocol (SFTP) should be used instead as it provides an encrypted session between client and server.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

For example, to copy a software image from an SFTP server to the primary image slot on the switch, using the management interface:

switch# copy sftp://[email protected]/TL_10_01_0001.swi primary vrf mgmt

Supportive Information

The following resource is also helpful.

• https://support.hpe.com/hpesc/public/docDisplay?docId=a00053695en_us

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system ArubaOS.

References

• 800-53|CM-7b.

Source

• Tenable.com/audits