Disable unsecure management services on Management, SVI, or Loopback interfaces

SrednjaNivo 1Automatskafortiswitch

Opis

Only secure management related services such as HTTPS, PING, SSH, SNMP, and RADIUS should be used on management interfaces. FAILs if any interface allowaccess list contains http or telnet. Audited against FortiSwitchOS 'show full-configuration' output (standalone FortiSwitch, saved in full); patterns are scoped to the named 'config ... end' block, whose member lines are indented.

Kako se proverava

Metod provere: Obrazac konfiguracije

Obrazac: (?m)^config system interface\n(?:[ \t]+[^\n]*\n)*?[ \t]+set allowaccess [^\n]*\b(?:telnet|http)\b[^\n]*[ \t]*$

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

config system interface edit "mgmt" set allowaccess https ping ssh snmp next end # CIS guidance: On GUI: Go to "System" > "Network" > "Interface". Review the Physical, VLAN, or Loopback interface and disable HTTP and Telnet services. On CLI: config system interface edit "mgmt" set allowaccess https ping ssh snmp Note: 1. Interface name may differ based on deployment. For this example, mgmt is a switch with a dedicated management interface. Switches without a management interface this would be set to "internal".

Svojstva

Operativni sistemi: Bilo koji
Oznake: fortiswitchmanagement
Referenca: CIS FortiSwitch Benchmark v1.0.0 - 1.4.2.1 Disable unsecure management services on Management, SVI, or Loopback interfaces

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target fortiswitch