TMA-PFSENSE-2.2
Ensure LDAP or RADIUS server configured
HighLevel 1Automatedpfsense
Description
Configured the LDAP Servers or Radius server for central authentication. PASS requires at least one LDAP or RADIUS authentication server. Audited against the pfSense config.xml (Diagnostics > Backup & Restore > Download configuration, or /cf/conf/config.xml).
How it is checked
Audit method: Configuration pattern
- Pattern
<authserver>(?:[^<]|<[^/<]|</[^a<]|</a[^u<]|</au[^t<]|</aut[^h<]|</auth[^s<]|</auths[^e<]|</authse[^r<]|</authser[^v<]|</authserv[^e<]|</authserve[^r<]|</authserver[^><])*?<type>(?:ldap|radius)</type>
How it is fixed
Fix method: Guidance or infrastructure patch
GUI: System > User Manager > Authentication Servers > Add: Type LDAP or RADIUS, fill in the server details, Save; then select it under System > User Manager > Settings. # CIS guidance: In the GUI: - Navigate to System > User Manager. - CLIck the Authentication Servers at the top. - Configure "Authentication Servers" Setting
Properties
- Operating systems
- Any
- Tags
- pfsenseauthentication
- Reference
- CIS pfSense Firewall Benchmark v1.1.0 - 2.2 Ensure LDAP or RADIUS server configured
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target pfsense