TMA-SOPHOS-1.1.1
Ensure admin session 'logout' for inactivity and 'block' is configured for failed sign-in
Deskripsi
Set to automatically sign out the administrator from the web admin console after the configured time of inactivity. (Default: 10 minutes) Set to block sign-in to the web admin console and CLI after the maximum numbers of failed sign-in attempts and the duration (in seconds) which attempts can be made from a single IP address. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).
Cara pemeriksaan
Metode audit: Tinjauan manual
Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.
Navigate to 'System > Administration > Admin and user settings > Login security' Verify that 'Logout admin session after _ Minutes of inactivity' is checked and configured with no more than 10 minutes of default value. Verify that 'Block login' is checked. Verify that 'After _ unsuccessful attempts from same IP in __ Seconds (1- 120)' is configured with values of 5 and 60 respectively. Verify that 'Block login access for __ minutes [1-60]' is set to at least 5.
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
Navigate to 'System > Administration > Admin and user settings > Login security'. Set 'Logout admin session after _ Minutes of inactivity' is checked and configured with no more than 10 minutes of default value. Set 'Block login' is checked. Set 'After _ unsuccessful attempts from same IP in __ Seconds (1-120)' is configured with values of 5 and 60 respectively. Set 'Block login access for __ minutes [1-60]' to at least 5
Properti
- Sistem operasi
- Apa saja
- Tag
- sophosauthentication
- Referensi
- CIS Sophos Firewall v22 Benchmark v1.0.0 - 1.1.1 Ensure admin session 'logout' for inactivity and 'block' is configured for failed sign-in