Ensure management GUI listens on secure TLS version

YüksekDüzey 1Otomatikfortiswitch

Açıklama

As we move towards better encryption capabilities, we need to also ensure GUI access is properly secured. TLS 1.3 is currently the most secure SSL/TLS supported version for SSL-encrypted administrator access (at this time of writing). PASS requires https-ssl-versions to be exactly tlsv1-3 in config system web. Audited against FortiSwitchOS 'show full-configuration' output (standalone FortiSwitch, saved in full); patterns are scoped to the named 'config ... end' block, whose member lines are indented.

Nasıl denetlenir

Denetim yöntemi: Yapılandırma deseni

Desen: (?m)^config system web\n(?:[ \t]+[^\n]*\n)*?[ \t]+set https-ssl-versions tlsv1-3[ \t]*$

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

config system web set https-ssl-versions tlsv1-3 end # CIS guidance: CLI: config system web set https-ssl-versions tlsv1-3 end

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: fortiswitchcrypto
Referans: CIS FortiSwitch Benchmark v1.0.0 - 1.2.1 Ensure management GUI listens on secure TLS version

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target fortiswitch