Ensure 'SSH source restriction' is set to an authorized IP address

VisokaNivo 1Automatskacisco-asa

Opis

Determines the client IP addresses that are allowed to connect to the security appliance through SSH. One key element of securing the network is the security of management access to the infrastructure devices. It is critical to establish the appropriate controls in order to prevent unauthorized access to infrastructure devices. Fails if no 'ssh <ip> <mask> <ifname>' source restriction exists or SSH is allowed from 0.0.0.0 0.0.0.0 / ::/0. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).

Kako se proverava

Metod provere: Obrazac konfiguracije

Obrazac: (?m)(?:\A(?:[ \t]*(?:$|[^s \t\n]|s(?:$|[^s\n]|s(?:$|[^h\n]|h(?:$|[^ \n]| (?:$|[^123456789\n])))))[^\n]*\n)*(?:[ \t]*(?:$|[^s \t\n]|s(?:$|[^s\n]|s(?:$|[^h\n]|h(?:$|[^ \n]| (?:$|[^123456789\n])))))[^\n]*)?\z)|(?:^ssh (?:0\.0\.0\.0 0\.0\.0\.0|::/0|0::0/0) )

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

! Run the following to enable SSH access source restriction ssh <source_ip> <source_netmask> <interface_name>

Svojstva

Operativni sistemi: Bilo koji
Oznake: cisco-asanetworkmanagement-plane
Referenca: CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 1.6.1 Ensure 'SSH source restriction' is set to an authorized IP address

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target cisco-asa