Ensure all the login accounts having specific trusted hosts enabled

ВысокийУровень 1Автоматическаяfortiswitch

Описание

Configure an administrative account to be accessible only to someone who is using a trusted host. You can set a specific IP address for the trusted host or use a subnet. FAILs if any administrator still has the default trusthost1 0.0.0.0 0.0.0.0. Audited against FortiSwitchOS 'show full-configuration' output (standalone FortiSwitch, saved in full); patterns are scoped to the named 'config ... end' block, whose member lines are indented.

Как проверяется

Метод проверки: Шаблон конфигурации

Шаблон: (?m)^config system admin\n(?:[ \t]+[^\n]*\n)*?[ \t]+set trusthost1 0\.0\.0\.0 0\.0\.0\.0[ \t]*$

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

config system admin edit "<admin>" set trusthost1 10.0.0.0 255.255.255.0 next end # CIS guidance: To remove a trusted host item from the list in CLI: config system admin edit "test_admin" unset trusthost1 end To add a trusted host into the list in CLI: config system admin edit "test_admin" set trusthost6 1.1.1.1 255.255.255.255 end Before adding an item, please make sure that it does not already exist. For example, if trusthost3 is already in the list, using it again will override the existing host/network. In the Web GUI: 1. System > Admin > Administrators. 2. Select the account "test_admin" and click on "Edit". 3. In the account setting page, make sure that "Restrict this Admin Login from Trusted Hosts Only" is enabled and all the allowed hosts / subnets are in the list of trusted hosts.

Свойства

Операционные системы: Любая
Теги: fortiswitchauthentication
Источник: CIS FortiSwitch Benchmark v1.0.0 - 1.6.1.1 Ensure all the login accounts having specific trusted hosts enabled

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

shell

tmaegis scan --target fortiswitch