Ensure 'NTLM' is set to 'Disabled'

AltaNivel 1Automatizadafirefox

Descripción

This policy setting controls the use of NT Lan Manager (NTLM) v1 protocol. This protocol is used for authentication to resources. The recommended state for this setting is: Disabled. Rationale: NTLM v1 contains cryptographic weaknesses that can be easily exploited to obtain user credentials. The policy is Disabled when it is not present: the audit prints 'absent' when the list key HKLM\SOFTWARE\Policies\Mozilla\Firefox\Authentication\NTLM is missing or empty, otherwise the configured entries.

Cómo se verifica

Método de auditoría: Registro de Windows

registry

$l = @((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Mozilla\Firefox\Authentication\NTLM' -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -notlike 'PS*' } | ForEach-Object { "$($_.Value)" }); if ($l.Count -eq 0) { 'absent' } else { 'configured: ' + ($l -join ', ') }

Salida esperada: absent

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Configure through Group Policy: Computer Configuration\Policies\Administrative Templates\Mozilla\Firefox\Authentication\NTLM = Disabled. Locally, remove the policy entries at HKLM\SOFTWARE\Policies\Mozilla\Firefox\Authentication\NTLM after reviewing them.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: firefoxbrowsercis-l1
Referencia: CIS Mozilla Firefox ESR GPO Benchmark v1.0.0 - 1.1.2.1 Ensure 'NTLM' is set to 'Disabled'

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target firefox