Ensure all the login accounts having specific trusted hosts enabled

HochStufe 1Automatisiertfortiswitch

Beschreibung

Configure an administrative account to be accessible only to someone who is using a trusted host. You can set a specific IP address for the trusted host or use a subnet. FAILs if any administrator still has the default trusthost1 0.0.0.0 0.0.0.0. Audited against FortiSwitchOS 'show full-configuration' output (standalone FortiSwitch, saved in full); patterns are scoped to the named 'config ... end' block, whose member lines are indented.

So wird geprüft

Prüfmethode: Konfigurationsmuster

Muster: (?m)^config system admin\n(?:[ \t]+[^\n]*\n)*?[ \t]+set trusthost1 0\.0\.0\.0 0\.0\.0\.0[ \t]*$

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

config system admin edit "<admin>" set trusthost1 10.0.0.0 255.255.255.0 next end # CIS guidance: To remove a trusted host item from the list in CLI: config system admin edit "test_admin" unset trusthost1 end To add a trusted host into the list in CLI: config system admin edit "test_admin" set trusthost6 1.1.1.1 255.255.255.255 end Before adding an item, please make sure that it does not already exist. For example, if trusthost3 is already in the list, using it again will override the existing host/network. In the Web GUI: 1. System > Admin > Administrators. 2. Select the account "test_admin" and click on "Edit". 3. In the account setting page, make sure that "Restrict this Admin Login from Trusted Hosts Only" is enabled and all the allowed hosts / subnets are in the list of trusted hosts.

Eigenschaften

Betriebssysteme: Beliebig
Tags: fortiswitchauthentication
Referenz: CIS FortiSwitch Benchmark v1.0.0 - 1.6.1.1 Ensure all the login accounts having specific trusted hosts enabled

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target fortiswitch