Ensure Login Protection methods are enabled.

How it is checked

Audit method: Configuration pattern

Pattern

<sshguard_threshold>(?:[1-9]|[12]\d|30)</sshguard_threshold>

How it is fixed

Fix method: Guidance or infrastructure patch

- Navigate to System > Access > Servers - Click the Plus Sign to add a TOTP Server - Give the server a descriptive name - Select the TOTP Server Type - Select a Token Length of 6 - Install Google Authenticator on your phone - Add a user from System > Access > Users - Enter a Username and Password and fill in the other fields just as you would do for any other user. Then select the Generate new (160bit) secret under OTP seed. - Click Save - For testing the user authentication, OPNsense offers a simple tester. Go to System ‣ Access ‣ Tester - Select the Authentication server you have configured, and enter the user name. Then enter the *token + password, remember the order is token and then password in the same field. - Hit the test button and if all goes well you should see successfully authenticated. - Per default the system validates user credentials against the “Local Database”. In System ‣ Settings ‣ Administration, section Authentication you should change this to your newly added authentication server to make sure no local user can gain access without 2FA.

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target opnsense