Fortinet FortiSwitch
TMA-FORTISWITCH-1.1.1
Ensure administrator password retries and lockout time are configured
Descripción
Failed login attempts can indicate malicious attempts to gain access to your network. To prevent this security risk, FortiSwitch is preconfigured to limit the number of failed administrator login attempts. After the maximum number of failed login attempts is reached, access to the account is blocked for the configured lockout period. PASS requires admin-lockout-threshold of 3 or less and admin-lockout-duration of 900 seconds or less, exactly as the CIS audit states (the CIS remediation value is 900). Audited against FortiSwitchOS 'show full-configuration' output (standalone FortiSwitch, saved in full); patterns are scoped to the named 'config ... end' block, whose member lines are indented.
Cómo se verifica
Método de auditoría: Patrón de configuración
- Patrón
(?m)^config system global\n(?:(?:[ \t]+[^\n]*\n)*?[ \t]+set admin-lockout-threshold [1-3][ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set admin-lockout-duration (?:[1-9]\d?|[1-8]\d\d|900)[ \t]*$|(?:[ \t]+[^\n]*\n)*?[ \t]+set admin-lockout-duration (?:[1-9]\d?|[1-8]\d\d|900)[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set admin-lockout-threshold [1-3][ \t]*$)
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
config system global set admin-lockout-threshold 3 set admin-lockout-duration 900 end # CIS guidance: To configure the lockout options, from CLI: config system global set admin-lockout-threshold 3 set admin-lockout-duration 900 end Lockout affects the offending IP address, not the entire account.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- fortiswitchauthentication
- Referencia
- CIS FortiSwitch Benchmark v1.0.0 - 1.1.1 Ensure administrator password retries and lockout time are configured
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
tmaegis scan --target fortiswitch