TMA-SOPHOS-1.1.6
Ensure management access to the device is restricted from selected IP addresses and disable from WAN Zone
Açıklama
It is recommended to limit exposure of Firewall administration services from WAN/untrusted zone. When necessary, leverage on remote VPN or limiting only from selected IP addresses, or use of Sophos Central for firewall administration. For additional security control - RBAC and administrative accounts can be enabled with 2-factor authentication using built-in RADIUS Server. By disabling ‘HTTPS', ‘SSH' and ‘Network services (PING/PING6, DNS, SMTP RELAY, SNMP)' on WAN zone to protect against reconnaissance attempts, network scanners and potential adversary. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).
Nasıl denetlenir
Denetim yöntemi: Manuel inceleme
Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.
Navigate to 'System > Administration > Device Access > Local service ACL'. Verify 'HTTPS,SSH,PING/PING6,DNS,SMTP RELAY, SNMP' on 'WAN Zone' is unchecked. Navigate to 'Local service ACL exception rule'. Verify that 'Added exception rule' only allows limited IP addresses for device management.
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
Navigate to 'System > Administration > Device Access > Local service ACL'. Uncheck 'HTTPS,SSH,PING/PING6,DNS,SMTP RELAY, SNMP' on 'WAN Zone'.
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- sophosfirewall-policy
- Referans
- CIS Sophos Firewall v22 Benchmark v1.0.0 - 1.1.6 Ensure management access to the device is restricted from selected IP addresses and disable from WAN Zone