Ensure management GUI listens on secure TLS version

HighLevel 1Automatedfortiswitch

Description

As we move towards better encryption capabilities, we need to also ensure GUI access is properly secured. TLS 1.3 is currently the most secure SSL/TLS supported version for SSL-encrypted administrator access (at this time of writing). PASS requires https-ssl-versions to be exactly tlsv1-3 in config system web. Audited against FortiSwitchOS 'show full-configuration' output (standalone FortiSwitch, saved in full); patterns are scoped to the named 'config ... end' block, whose member lines are indented.

How it is checked

Audit method: Configuration pattern

Pattern: (?m)^config system web\n(?:[ \t]+[^\n]*\n)*?[ \t]+set https-ssl-versions tlsv1-3[ \t]*$

How it is fixed

Fix method: Guidance or infrastructure patch

config system web set https-ssl-versions tlsv1-3 end # CIS guidance: CLI: config system web set https-ssl-versions tlsv1-3 end

Properties

Operating systems: Any
Tags: fortiswitchcrypto
Reference: CIS FortiSwitch Benchmark v1.0.0 - 1.2.1 Ensure management GUI listens on secure TLS version

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target fortiswitch