TMA-FLASHARRAY-2.3
Ensure Active Directory accounts are configured to require TLS
Mô tả
FlashArray supports native integration with Active Directory domains in order to enable LDAP lookups for authorization, and Kerberos authentication. FlashArray does this by creating a computer account in the domain to represent itself and generate kerberos keys. A unique AD account may be created for each server on the array that needs one. Manual review in the Purity//FA GUI or CLI (organization-specific or per-object evidence).
Cách kiểm tra
Phương pháp kiểm tra: Xem xét thủ công
Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.
From the CLI: ; Run the command puread account list to display information about Active Directory account attributes. ; Review the output and verify that the TLS column for the configured AD account is set to required (rather than optional).
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
To align with the security recommendations, update your Active Directory account configuration to explicitly require TLS for all domain controller communications. From the GUI: ; Navigate to Settings > Access > Users and Policies or Storage > Servers depending on where the AD account is applied. ; Edit the Active Directory configuration (e.g., in the Configure Remote Directory Service window). ; Under the TLS Mode setting, select the required radio button to force TLS communication with the domain controller. ; Click Create (or Save) to apply the configuration. From the CLI: ; Update the Active Directory account to require TLS using the puread account setattr command.
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- flasharraystorageencryption
- Tham chiếu
- CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 2.3 Ensure Active Directory accounts are configured to require TLS