Access protections for SSH keys
For compliance, user access to SSH keys and debug data must be disabled.
Standards
CC-NDcPP
CLI configuration command
no compliance options user-key-access enable
CLI show commands
show compliance options
show running-config
Audit logging priority levels
For compliance, audit logging must be enabled at the priority level “notice” or “info.” This change is applied to local logging and to any configured remote syslog servers. All local log sinks must be logging at a compliant priority. For remote logging, at least one logging host must be logging at a compliant priority.
Standards
FIPS 140-3, CC-NDcPP
CLI configuration commands
logging local notice
If class overrides are configured, set the priority to notice:
logging local override class <class-name> priority notice
logging local override class <class-name> priority notice
If a logging host is defined:
logging <host> trap notice
If class overrides are configured, set the priority to notice:
logging <host> trap override
logging <host> trap override class <class-name> priority notice
CLI show command
show logging
Audit logging of secure channels
For compliance, audit information is changed regarding the establishment, termination, and failure of secure TLS and SSH channels.
Standards
CC-NDcPP
CLI configuration command
compliance options secure-channel-logs enable
CLI show command
show compliance options