cisco-security-auditlisted

## Cisco Security Audit Scripts Write Python scripts that audit and validate Cisco device security. Follow these standards: ### Audit Categories #### Device Hardening (CIS Benchmark / STIG aligned) - Check for `service password-encryption` - Verify `enable secret` (not `enable password`) - Ensure `no ip http server` (or HTTPS only with ACL) - Check `login block-for` and `login delay` settings - Verify unused interfaces are shut down and in a blackhole VLAN - Check banner motd / login presence - Verify `no cdp run` on external interfaces - Check `no ip source-route`, `no ip directed-broadcast` - Verify VTY line ACLs and `transport input ssh` - Ensure `ip ssh version 2` and no Telnet #### AAA & Access Control - Verify AAA new-model configuration - Check TACACS+/RADIUS server configuration - Validate local fallback account exists - Review privilege levels and role-based access - Check console and AUX line security #### Routing Security - Verify routing protocol authentication (OSPF MD5/SHA, BGP MD5, EIGRP) - Check for route filtering on external peers - Validate uRPF (unicast reverse path forwarding) - Check for `no ip proxy-arp` on appropriate interfaces #### ACL Review - Parse and analyze all ACLs - Flag overly permissive rules (`permit ip any any`) - Identify shadowed rules (unreachable ACEs) - Check ACL application to interfaces (in/out) - Verify management ACLs on VTY lines #### ASA / Firewall Specific - Validate security levels on interfaces - Check NAT rules for ex