Allow only trusted hosts in SNMPv3

ÉlevéeNiveau 2Automatiséefortigate

Description

Ensuring that only certain hosts are able to conduct SNMP GET or receive SNMP Trap. FAILs if any SNMPv3 user lists 0.0.0.0 in notify-hosts. Audited against FortiOS 'show full-configuration' output (run it from the global context on VDOM-enabled units and save the full output); patterns are scoped to the named 'config ... end' block, whose member lines are indented.

Méthode de vérification

Méthode d'audit: Motif de configuration

Motif: (?m)^config system snmp user\n(?:[ \t]+[^\n]*\n)*?[ \t]+set notify-hosts [^\n]*\b0\.0\.0\.0\b[^\n]*[ \t]*$

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

config system snmp user edit "<user>" unselect notify-hosts 0.0.0.0 set notify-hosts <nms-ip> next end # CIS guidance: To remove 0.0.0.0 from trusted hosts in CLI: config system snmp user edit "snmp_test" unselect notify-hosts 0.0.0.0 end From GUI: 1. System > SNMP. 2. On SNMPv3 section, double click on the configured SNMPv3 settings. 3. Remove 0.0.0.0 from "Hosts" option.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: fortigatesnmp
Référence: CIS FortiGate 7.4.x Benchmark v1.0.1 - 2.3.2 Allow only trusted hosts in SNMPv3

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target fortigate --level 2