Ensure only SNMPv3 is enabled

Cómo se verifica

Método de auditoría: Patrón de configuración

Patrón

(?ms)^config system snmp sysinfo\n(?:[ \t]+[^\n]*\n)*?[ \t]+set status enable[ \t]*\n.*?^config system snmp community\nend[ \t]*$.*?^config system snmp user\n[ \t]+edit

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

config system snmp sysinfo set status enable end config system snmp community delete <id> end config system snmp user edit "snmp_v3" set security-level auth-priv set auth-proto sha256 set auth-pwd <password> set priv-proto aes256 set priv-pwd <password> next end # CIS guidance: To enable SNMP agent in CLI: config system snmp sysinfo set status enable end In GUI, go to System > SNMP and enable SNMP Agent. To delete SNMPv1/2c communities. In this example, we'll delete community "public" in CLI: First, to identify the community, run config system snmp community show config system snmp community edit 1 set name "public" config hosts edit 1 next end next end This shows that the community public has ID 1 config system snmp community delete 1 end In the GUI, go to: System > SNMP, select the community and click on the Delete button. To add SNMPv3 user in CLI: config system snmp user edit "snmp_test" set security-level auth-priv set auth-proto sha256 set auth-pwd xxxx set priv-proto aes256 set priv_pwd xxxx end In the GUI, go to: 1. System > SNMP, under SNMPv3, click on "Create New" button. 2. Select "Authentication" and choose SHA256 as Authentication algorithm. 3. Click "Change" to type in the password. 4. Also select option "Private", choose AES256 as Encryption Algorithm. 5. Click on "Change" to change the password. Click "OK" to add the new user. 6. Click apply to apply the new setting into the current config.

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

tmaegis scan --target fortigate