Allow only trusted hosts in SNMPv3

AltaNivel 2Automatizadafortiswitch

Descripción

Ensuring that only certain hosts are able to conduct SNMP GET or receive SNMP Trap. FAILs if any SNMPv3 user lists 0.0.0.0 in notify-hosts. Audited against FortiSwitchOS 'show full-configuration' output (standalone FortiSwitch, saved in full); patterns are scoped to the named 'config ... end' block, whose member lines are indented.

Cómo se verifica

Método de auditoría: Patrón de configuración

Patrón: (?m)^config system snmp user\n(?:[ \t]+[^\n]*\n)*?[ \t]+set notify-hosts [^\n]*\b0\.0\.0\.0\b[^\n]*[ \t]*$

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

config system snmp user edit "<user>" set notify-hosts <nms-ip> next end # CIS guidance: To remove 0.0.0.0 from trusted hosts in CLI: config system snmp user edit "snmp_test" unset notify-hosts end From GUI: 1. System > Config > SNMP > Users. 2. On the Users section click "Edit" on "snmp_test". 3. Remove 0.0.0.0 from "Notify Hosts" section.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: fortiswitchsnmp
Referencia: CIS FortiSwitch Benchmark v1.0.0 - 1.5.1.2 Allow only trusted hosts in SNMPv3

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target fortiswitch --level 2