Ensure management GUI listens on secure TLS version

높음레벨 1자동fortiswitch

설명

As we move towards better encryption capabilities, we need to also ensure GUI access is properly secured. TLS 1.3 is currently the most secure SSL/TLS supported version for SSL-encrypted administrator access (at this time of writing). PASS requires https-ssl-versions to be exactly tlsv1-3 in config system web. Audited against FortiSwitchOS 'show full-configuration' output (standalone FortiSwitch, saved in full); patterns are scoped to the named 'config ... end' block, whose member lines are indented.

점검 방법

감사 방식: 구성 패턴

패턴: (?m)^config system web\n(?:[ \t]+[^\n]*\n)*?[ \t]+set https-ssl-versions tlsv1-3[ \t]*$

조치 방법

조치 방식: 가이드 또는 인프라 패치

config system web set https-ssl-versions tlsv1-3 end # CIS guidance: CLI: config system web set https-ssl-versions tlsv1-3 end

속성

운영 체제: 모두
태그: fortiswitchcrypto
참고 자료: CIS FortiSwitch Benchmark v1.0.0 - 1.2.1 Ensure management GUI listens on secure TLS version

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target fortiswitch