Ensure 'SSH source restriction' is set to an authorized IP address

TinggiLevel 1Otomatiscisco-asa

Deskripsi

Determines the client IP addresses that are allowed to connect to the security appliance through SSH. One key element of securing the network is the security of management access to the infrastructure devices. It is critical to establish the appropriate controls in order to prevent unauthorized access to infrastructure devices. Fails if no 'ssh <ip> <mask> <ifname>' source restriction exists or SSH is allowed from 0.0.0.0 0.0.0.0 / ::/0. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).

Cara pemeriksaan

Metode audit: Pola konfigurasi

Pola: (?m)(?:\A(?:[ \t]*(?:$|[^s \t\n]|s(?:$|[^s\n]|s(?:$|[^h\n]|h(?:$|[^ \n]| (?:$|[^123456789\n])))))[^\n]*\n)*(?:[ \t]*(?:$|[^s \t\n]|s(?:$|[^s\n]|s(?:$|[^h\n]|h(?:$|[^ \n]| (?:$|[^123456789\n])))))[^\n]*)?\z)|(?:^ssh (?:0\.0\.0\.0 0\.0\.0\.0|::/0|0::0/0) )

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

! Run the following to enable SSH access source restriction ssh <source_ip> <source_netmask> <interface_name>

Properti

Sistem operasi: Apa saja
Tag: cisco-asanetworkmanagement-plane
Referensi: CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 1.6.1 Ensure 'SSH source restriction' is set to an authorized IP address

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target cisco-asa