Ensure management GUI listens on secure TLS version

AltaNivel 1Automatizadafortiswitch

Descripción

As we move towards better encryption capabilities, we need to also ensure GUI access is properly secured. TLS 1.3 is currently the most secure SSL/TLS supported version for SSL-encrypted administrator access (at this time of writing). PASS requires https-ssl-versions to be exactly tlsv1-3 in config system web. Audited against FortiSwitchOS 'show full-configuration' output (standalone FortiSwitch, saved in full); patterns are scoped to the named 'config ... end' block, whose member lines are indented.

Cómo se verifica

Método de auditoría: Patrón de configuración

Patrón: (?m)^config system web\n(?:[ \t]+[^\n]*\n)*?[ \t]+set https-ssl-versions tlsv1-3[ \t]*$

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

config system web set https-ssl-versions tlsv1-3 end # CIS guidance: CLI: config system web set https-ssl-versions tlsv1-3 end

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: fortiswitchcrypto
Referencia: CIS FortiSwitch Benchmark v1.0.0 - 1.2.1 Ensure management GUI listens on secure TLS version

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target fortiswitch