TMA-PFSENSE-4.1.2

Ensure no Allow Rule with Any in Source field present in the Firewall Rules

高レベル 1自動pfsense

説明

The Firewall Rules with Any in the Destination field allows accessing all the IP Addresses of Network from specified Sources configured in the Firewall rules for specific services FAILs if any pass rule in config.xml has source any (disabled rules are also flagged). Audited against the pfSense config.xml (Diagnostics > Backup & Restore > Download configuration, or /cf/conf/config.xml).

チェック方法

監査方法: 設定パターン

パターン: <rule>(?:[^<]|<[^/<]|</[^r<]|</r[^u<]|</ru[^l<]|</rul[^e<]|</rule[^><])*?<type>pass</type>(?:[^<]|<[^/<]|</[^r<]|</r[^u<]|</ru[^l<]|</rul[^e<]|</rule[^><])*?<source>\s*(?:<any\s*/>|<any>\s*</any>)\s*</source>

修正方法

修正方法: ガイダンスまたは IaC パッチ

GUI: Firewall > Rules > <interface>: edit each pass rule with Source any and set a specific host/network alias, or disable/delete it, Apply Changes. # CIS guidance: Delete the rule from the firewall which has Any used in the Source field.

プロパティ

オペレーティングシステム: すべて
タグ: pfsensefirewall-policy
参照: CIS pfSense Firewall Benchmark v1.1.0 - 4.1.2 Ensure no Allow Rule with Any in Source field present in the Firewall Rules

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target pfsense