Ensure management GUI listens on secure TLS version

TinggiLevel 1Otomatisfortiswitch

Deskripsi

As we move towards better encryption capabilities, we need to also ensure GUI access is properly secured. TLS 1.3 is currently the most secure SSL/TLS supported version for SSL-encrypted administrator access (at this time of writing). PASS requires https-ssl-versions to be exactly tlsv1-3 in config system web. Audited against FortiSwitchOS 'show full-configuration' output (standalone FortiSwitch, saved in full); patterns are scoped to the named 'config ... end' block, whose member lines are indented.

Cara pemeriksaan

Metode audit: Pola konfigurasi

Pola: (?m)^config system web\n(?:[ \t]+[^\n]*\n)*?[ \t]+set https-ssl-versions tlsv1-3[ \t]*$

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

config system web set https-ssl-versions tlsv1-3 end # CIS guidance: CLI: config system web set https-ssl-versions tlsv1-3 end

Properti

Sistem operasi: Apa saja
Tag: fortiswitchcrypto
Referensi: CIS FortiSwitch Benchmark v1.0.0 - 1.2.1 Ensure management GUI listens on secure TLS version

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target fortiswitch