Encrypt Log Transmission to Syslog

HochStufe 1Automatisiertfortiswitch

Beschreibung

Enable encryption for logs that are sent to a SIEM, FortiAnalyzer, or FortiManager. PASS requires syslog mode reliable and enc-algorithm high in config log syslogd setting. Audited against FortiSwitchOS 'show full-configuration' output (standalone FortiSwitch, saved in full); patterns are scoped to the named 'config ... end' block, whose member lines are indented.

So wird geprüft

Prüfmethode: Konfigurationsmuster

Muster: (?m)^config log syslogd setting\n(?:(?:[ \t]+[^\n]*\n)*?[ \t]+set mode reliable[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set enc-algorithm high[ \t]*$|(?:[ \t]+[^\n]*\n)*?[ \t]+set enc-algorithm high[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set mode reliable[ \t]*$)

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

config log syslogd setting set mode reliable set enc-algorithm high end # CIS guidance: Secure log transfer settings can only be configured on CLI: config log syslogd setting set mode reliable set enc-algorithm high end

Eigenschaften

Betriebssysteme: Beliebig
Tags: fortiswitchlogging
Referenz: CIS FortiSwitch Benchmark v1.0.0 - 3.1.3.1 Encrypt Log Transmission to Syslog

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target fortiswitch