TMA-PFSENSE-4.1.1
Ensure no Allow Rule with Any in Destination Field present in the Firewall Rules
Descrição
The Firewall Rules with Any in Source field allows all the IP Addresses of the Network to access the specified destination configured in the Firewall rules for specific services. FAILs if any pass rule in config.xml has destination any (disabled rules and the default LAN allow-any rule are also flagged, as the CIS default notes). Audited against the pfSense config.xml (Diagnostics > Backup & Restore > Download configuration, or /cf/conf/config.xml).
Como é verificado
Método de auditoria: Padrão de configuração
- Padrão
<rule>(?:[^<]|<[^/<]|</[^r<]|</r[^u<]|</ru[^l<]|</rul[^e<]|</rule[^><])*?<type>pass</type>(?:[^<]|<[^/<]|</[^r<]|</r[^u<]|</ru[^l<]|</rul[^e<]|</rule[^><])*?<destination>\s*(?:<any\s*/>|<any>\s*</any>)\s*</destination>
Como é corrigido
Método de correção: Orientação ou patch de infraestrutura
GUI: Firewall > Rules > <interface>: edit each pass rule with Destination any and set a specific host/network alias, or disable/delete it, Apply Changes. # CIS guidance: Delete or Disable the rule from the firewall which has Any used in the Destination field.
Propriedades
- Sistemas operacionais
- Qualquer
- Tags
- pfsensefirewall-policy
- Referência
- CIS pfSense Firewall Benchmark v1.1.0 - 4.1.1 Ensure no Allow Rule with Any in Destination Field present in the Firewall Rules
Verificar este host
Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.
tmaegis scan --target pfsense