TMA-IIS-7.8
Ensure DES Cipher Suites is Disabled
VisokaNivo 1Automatskaiis
Opis
The DES Cipher Suite is considered a weak symmetric-key cipher, therefore it is recommended that it be disabled. SCHANNEL\Ciphers\DES 56/56 must exist with Enabled=0 (read via the .NET registry API because the key names contain "/"). PowerShell 5.1; reads the registry (run elevated).
Kako se proverava
Metod provere: Windows registar
registry
$c = 'SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers'; function Get-Cipher($n) { $k = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey("$c\$n"); $v = $null; if ($k) { $v = $k.GetValue('Enabled'); $k.Close() }; $v }; $bad = @('DES 56/56' | Where-Object { $v = Get-Cipher $_; $null -eq $v -or [long]$v -ne 0 }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' }- Očekivani izlaz
compliant
Kako se ispravlja
Metod ispravke: Smernica ili zakrpa infrastrukture
([Microsoft.Win32.Registry]::LocalMachine.CreateSubKey('SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56')).SetValue('Enabled', 0, 'DWord') for each listed cipher (PowerShell drive paths cannot contain '/'), then reboot.
Svojstva
- Operativni sistemi
- Bilo koji
- Oznake
- iistls
- Referenca
- CIS Microsoft IIS 10 Benchmark v1.2.1 - 7.8 Ensure DES Cipher Suites is Disabled
Proverite ovaj računar
Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.
shell
tmaegis scan --target iis