TMA-FLASHARRAY-3.2
Ensure SMB client policies require encryption, restrict client access, and disable anonymous access
Mô tả
SMB Client Policies are used to control access to any given file system export over any version of the SMB protocol. They can set properties such as SMB encryption requirements, and read-only vs. read-write based on client network identity. Fails when an SMB client rule uses the * client, does not require SMB encryption, or allows anonymous access. Note: a * client in any exported rule list (NFS included) also fails this check. The audit is a config_regex check against a text export of the Purity//FA CLI, supplied with --device-config. Capture it over SSH with the --nvp (name=value) output option, for example: ssh pureuser@<array> "purepolicy smb rule list --nvp" > flasharray.txt (one file may hold the output of all commands used by this pack).
Cách kiểm tra
Phương pháp kiểm tra: Mẫu cấu hình
- Mẫu khớp
(?im)(?:\bclient[ \t]*[=:]?[ \t]*\*(?:\s|$)|smb[ _-]?encryption[ _-]?required[ \t]*[=:]?[ \t]*false|anonymous[ _-]?access[ _-]?allowed[ \t]*[=:]?[ \t]*true)
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
To align with the security recommendations, update your SMB client policy rules to constrain client IPs, require SMB encryption, and ensure anonymous access remains disabled. From the GUI: ; Navigate to Storage > Policies. ; In the Export Policies panel, click the name of the SMB policy to modify. ; In the Rules panel, click the + (Create Rule) icon to add a new, secure rule. (Note: Modifying existing SMB rules via the GUI is done by adding a new rule and removing the non-compliant one). ; Set the Client field to a specific IP subnet (e.g., 192.168.10.0/24). ; Ensure the SMB Encryption Required toggle is enabled (blue). ; Ensure the Anonymous Access Allowed toggle is disabled (gray).
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- flasharraystoragefile-services
- Tham chiếu
- CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 3.2 Ensure SMB client policies require encryption, restrict client access, and disable anonymous access
Kiểm tra máy này
Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.
tmaegis scan --target flasharray