TMA-PALOALTO-1.2.3
Ensure HTTP and Telnet options are disabled for the management interface
Descripción
HTTP and Telnet options should not be enabled for device management. PASS requires both disable-telnet yes and disable-http yes under deviceconfig system service. Audited against the PAN-OS running configuration in set format: run 'set cli config-output-format set', then 'configure' and 'show' (or 'show config running') and save the full output.
Cómo se verifica
Método de auditoría: Patrón de configuración
- Patrón
(?m)(?:^set (?:template \S+ config )?deviceconfig system service disable-telnet yes[ \t]*$(?s:.*?)^set (?:template \S+ config )?deviceconfig system service disable-http yes[ \t]*$|^set (?:template \S+ config )?deviceconfig system service disable-http yes[ \t]*$(?s:.*?)^set (?:template \S+ config )?deviceconfig system service disable-telnet yes[ \t]*$)
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
configure set deviceconfig system service disable-telnet yes set deviceconfig system service disable-http yes commit # CIS guidance: Navigate to Device > Setup > Interfaces > Management. Set the HTTP and Telnet boxes to unchecked.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- paloaltomanagement
- Referencia
- CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 1.2.3 Ensure HTTP and Telnet options are disabled for the management interface
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
tmaegis scan --target paloalto