Ensure 'HTTP source restriction' is set to an authorized IP address

높음레벨 2자동cisco-asa

설명

Determines the client IP addresses that are allowed to connect to the security appliance through HTTP. One key element of securing the network is the security of management access to the infrastructure devices. It is critical to establish the appropriate controls in order to prevent unauthorized access to infrastructure devices. Fails if HTTP/ASDM access is allowed from any address, or 'http server enable' is set without any 'http <ip> <mask> <ifname>' restriction. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).

점검 방법

감사 방식: 구성 패턴

패턴: (?m)(?:^http (?:0\.0\.0\.0 0\.0\.0\.0|::/0|0::0/0) )|(?:\A(?:[ \t]*(?:$|[^h \t\n]|h(?:$|[^t\n]|t(?:$|[^t\n]|t(?:$|[^p\n]|p(?:$|[^ \n]| (?:$|[^123456789\n]))))))[^\n]*\n)*[ \t]*http server enable[^\n]*(?:\n(?:[ \t]*(?:$|[^h \t\n]|h(?:$|[^t\n]|t(?:$|[^t\n]|t(?:$|[^p\n]|p(?:$|[^ \n]| (?:$|[^123456789\n]))))))[^\n]*))*\n?\z)

조치 방법

조치 방식: 가이드 또는 인프라 패치

! Run the following to enable HTTP access source restriction http <source_ip> <source_netmask> <interface_name>

속성

운영 체제: 모두
태그: cisco-asanetworkmanagement-plane
참고 자료: CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 1.7.1 Ensure 'HTTP source restriction' is set to an authorized IP address

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target cisco-asa --level 2