Ensure 'Maximum SSL version enabled' is set to 'Enabled: TLS 1.3'

TinggiLevel 1Otomatisfirefox

Deskripsi

This setting sets the maximum required protocol version for the Transport Layer Security (TLS). The recommended state for this setting is: Enabled:TLS 1.3. Rationale: Setting TLS 1.3 as the maximum authorized protocol version mitigates the risk of using an insecure connection. Audit reads the Group Policy registry value and prints 'compliant', 'unset' (policy not configured, reported as FAIL) or the non-compliant value. Registry value: HKLM\SOFTWARE\Policies\Mozilla\Firefox:SSLVersionMax (REG_SZ); compliant when it is 'tls1.3' (whitespace-insensitive). Remediation writes tls1.3 locally; in a domain set it through the ADMX so Group Policy does not revert it.

Cara pemeriksaan

Metode audit: Registry Windows

registry

$v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Mozilla\Firefox' -Name 'SSLVersionMax' -ErrorAction SilentlyContinue).'SSLVersionMax'; if ($null -eq $v) { 'unset' } elseif (($null -ne $v -and ("$v" -replace '\s','') -eq 'tls1.3')) { 'compliant' } else { "non-compliant: $v" }

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Perintah shell

shell

$p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Mozilla\Firefox'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'SSLVersionMax' -Value 'tls1.3' -PropertyType String -Force | Out-Null

Properti

Sistem operasi: Apa saja
Tag: firefoxbrowsercis-l1
Referensi: CIS Mozilla Firefox ESR GPO Benchmark v1.0.0 - 1.1.37 Ensure 'Maximum SSL version enabled' is set to 'Enabled: TLS 1.3'

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target firefox