Allow local user for only ASA admin and not RA VPN

[ABaker94985]

We are trying to remediate the RA VPN vulnerability of CVE-2023-20269. We use TACACS+ to login, but there is a local backup account in case TACACS+ goes down. Is there some way to prevent this account from being utilized by AnyConnect?

I understand we can lock a userame into a profile, but I don't believe that's what I'm intending on doing.

Thanks

[Rob Ingram · Accepted solution]

@ABaker94985 try this:-

When users in the LOCAL user database are not expected to be able to establish remote access VPN tunnels at all, administrators can prevent these users from successfully establishing a remote access VPN tunnel by setting the vpn-simultaneous-logins option in username attributes configuration mode to zero, as shown in the following example:

username USERNAMAE attributes
 vpn-simultaneous-logins 0 

[ABaker94985]

Thanks, Rob. That's exactly what I was needing.

[plwalsh]

Regarding this recent vulnerability to 'brute force attack in an attempt to identify valid username and password combinations ' , is the ASA brute force vulnerability only related to LOCAL usernames? i.e. if I apply the various workarounds to any LOCAL usernames, does that mitigate the vulnerability?  I don't have clientless SSL VPN so that's not an issue for me.

[ABaker94985]

My understanding is that there are two way to compromise the ASA. One through brute force local usernames and the other using clientless SSL. Clientless was not an issue for us either. However, our ASA was hammered with attempts to compromise the local usernames as shown in the following:

pri/act/asa5545(config)# sh logg | in 113015
Sep 08 2023 00:36:44: %ASA-6-113015: AAA user authentication Rejected : reason = User was not found : local database : user = ***** : user IP = 152.89.198.38