Sophos Firewall
TMA-SOPHOS-1.1.4
Ensure SSL server certificate for remote SSL VPN is configured correctly
Opis
The Certificate used to secure SSL VPN should satisfy the following criteria. It should be a valid certificate from a trusted source. In most cases this means a trusted Public Certificate Authority as remote sslvpn users may not have access to any Private Certificate Authorities for Certificate validation. The certificate should have a valid date. It should not have a "to" date in the past (it should not be expired), and should not have a "from" date in the future. The key length used to encrypt the certificate should be 2048 bits or more. The hash used to sign the certificate should be SHA-2 or better. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).
Kako se proverava
Metod provere: Ručni pregled
Verify that the certificate being used to secure the SSL VPN meets the criteria listed. Navigate to 'System > Administration > Admin and User settings > Admin console and end-user interaction > Certificate' Ensure that a valid certificate is applied to the User portal. Navigate to 'Configure > Remote Access VPN > SSL VPN > SSL VPN global settings > SSL server certificate'. Ensure that a valid certificate is used for the SSL VPN Gateway.
Kako se ispravlja
Metod ispravke: Smernica ili zakrpa infrastrukture
Create a CSR and install a certificate from a public CA. Navigate to 'System > Administration > Admin and User settings > Admin console and end-user interaction > Certificate'. Set a valid certificate to the User portal. Navigate to 'Configure > Remote Access VPN > SSL VPN > SSL VPN global settings > SSL server certificate'. Set a valid certificate for the SSL VPN Gateway.
Svojstva
- Operativni sistemi
- Bilo koji
- Oznake
- sophoscrypto
- Referenca
- CIS Sophos Firewall v22 Benchmark v1.0.0 - 1.1.4 Ensure SSL server certificate for remote SSL VPN is configured correctly