Ensure “Default Restrict” is set in all client lists

YüksekDüzey 1Otomatikjuniper-junos

Açıklama

Limit clients to access SNMP. Even when limited to read only access, SNMP can provide an attacker with a wealth of information about your router and network topology. To limit the potential for attacks against your routers SNMP service your client lists should be configured to deny any ... Passes when no client-list exists; otherwise requires 'default restrict'. Audited against the output of 'show configuration | display set | no-more' (set format, not the curly-brace hierarchy).

Nasıl denetlenir

Denetim yöntemi: Yapılandırma deseni

Desen: (?m)\A(?:(?:[ \t]*(?:$|[^s \t\n]|s(?:$|[^e\n]|e(?:$|[^t\n]|t(?:$|[^ \n]| (?:$|[^s\n]|s(?:$|[^n\n]|n(?:$|[^m\n]|m(?:$|[^p\n]|p(?:$|[^ \n]| (?:$|[^c\n]|c(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^e\n]|e(?:$|[^n\n]|n(?:$|[^t\n]|t(?:$|[^\-\n]|-(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^s\n]|s(?:$|[^t\n]|t(?:$|[^ \n])))))))))))))))))))))[^\n]*|[ \t]*set snmp client-list (?:(?:[^d \t\n][^ \t\n]*|d(?:|[^e \t\n][^ \t\n]*|e(?:|[^f \t\n][^ \t\n]*|f(?:|[^a \t\n][^ \t\n]*|a(?:|[^u \t\n][^ \t\n]*|u(?:|[^l \t\n][^ \t\n]*|l(?:|[^t \t\n][^ \t\n]*|t(?:[^ \t\n][^ \t\n]*))))))))[ \t]+)*(?:(?:[^d \t\n][^ \t\n]*|d(?:|[^e \t\n][^ \t\n]*|e(?:|[^f \t\n][^ \t\n]*|f(?:|[^a \t\n][^ \t\n]*|a(?:|[^u \t\n][^ \t\n]*|u(?:|[^l \t\n][^ \t\n]*|l(?:|[^t \t\n][^ \t\n]*|t(?:[^ \t\n][^ \t\n]*)))))))))?)\n)*[ \t]*set snmp client-list (?:(?:[^d \t\n][^ \t\n]*|d(?:|[^e \t\n][^ \t\n]*|e(?:|[^f \t\n][^ \t\n]*|f(?:|[^a \t\n][^ \t\n]*|a(?:|[^u \t\n][^ \t\n]*|u(?:|[^l \t\n][^ \t\n]*|l(?:|[^t \t\n][^ \t\n]*|t(?:[^ \t\n][^ \t\n]*))))))))[ \t]+)*(?:(?:[^d \t\n][^ \t\n]*|d(?:|[^e \t\n][^ \t\n]*|e(?:|[^f \t\n][^ \t\n]*|f(?:|[^a \t\n][^ \t\n]*|a(?:|[^u \t\n][^ \t\n]*|u(?:|[^l \t\n][^ \t\n]*|l(?:|[^t \t\n][^ \t\n]*|t(?:[^ \t\n][^ \t\n]*)))))))))?(?:\n(?:(?:[ \t]*(?:$|[^s \t\n]|s(?:$|[^e\n]|e(?:$|[^t\n]|t(?:$|[^ \n]| (?:$|[^s\n]|s(?:$|[^n\n]|n(?:$|[^m\n]|m(?:$|[^p\n]|p(?:$|[^ \n]| (?:$|[^c\n]|c(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^e\n]|e(?:$|[^n\n]|n(?:$|[^t\n]|t(?:$|[^\-\n]|-(?:$|[^l\n]|l(?:$|[^i\n]|i(?:$|[^s\n]|s(?:$|[^t\n]|t(?:$|[^ \n])))))))))))))))))))))[^\n]*|[ \t]*set snmp client-list (?:(?:[^d \t\n][^ \t\n]*|d(?:|[^e \t\n][^ \t\n]*|e(?:|[^f \t\n][^ \t\n]*|f(?:|[^a \t\n][^ \t\n]*|a(?:|[^u \t\n][^ \t\n]*|u(?:|[^l \t\n][^ \t\n]*|l(?:|[^t \t\n][^ \t\n]*|t(?:[^ \t\n][^ \t\n]*))))))))[ \t]+)*(?:(?:[^d \t\n][^ \t\n]*|d(?:|[^e \t\n][^ \t\n]*|e(?:|[^f \t\n][^ \t\n]*|f(?:|[^a \t\n][^ \t\n]*|a(?:|[^u \t\n][^ \t\n]*|u(?:|[^l \t\n][^ \t\n]*|l(?:|[^t \t\n][^ \t\n]*|t(?:[^ \t\n][^ \t\n]*)))))))))?)))*\n?\z

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

! To configure a client list issue the following command under the hierarchy; set snmp client-list <client list name> default restrict Note - Client-lists may also be defined directly under the hierarchy for use within the specified community with the same effect, but for ease of management and audit, the first method is preferred.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: juniper-junosnetworkmanagement-plane
Referans: CIS Juniper OS Benchmark v2.1.0 - 5.4 Ensure “Default Restrict” is set in all client lists

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target juniper-junos