Ensure management GUI listens on secure TLS version

HochStufe 1Automatisiertfortiswitch

Beschreibung

As we move towards better encryption capabilities, we need to also ensure GUI access is properly secured. TLS 1.3 is currently the most secure SSL/TLS supported version for SSL-encrypted administrator access (at this time of writing). PASS requires https-ssl-versions to be exactly tlsv1-3 in config system web. Audited against FortiSwitchOS 'show full-configuration' output (standalone FortiSwitch, saved in full); patterns are scoped to the named 'config ... end' block, whose member lines are indented.

So wird geprüft

Prüfmethode: Konfigurationsmuster

Muster: (?m)^config system web\n(?:[ \t]+[^\n]*\n)*?[ \t]+set https-ssl-versions tlsv1-3[ \t]*$

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

config system web set https-ssl-versions tlsv1-3 end # CIS guidance: CLI: config system web set https-ssl-versions tlsv1-3 end

Eigenschaften

Betriebssysteme: Beliebig
Tags: fortiswitchcrypto
Referenz: CIS FortiSwitch Benchmark v1.0.0 - 1.2.1 Ensure management GUI listens on secure TLS version

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target fortiswitch