TMA-GITHUB-1.3.5

Ensure the organization is requiring members to use Multi- Factor Authentication (MFA)

CaoCấp 2Tự độnggithub

Mô tả

Require members of the organization to use Multi-Factor Authentication (MFA) in addition to a standard user name and password when authenticating to the source code management platform. By default every user authenticates within the system by password only. If the password of a user is compromised, however, the user account and every repository to which they have access are in danger of data loss ... two_factor_requirement_enabled must be true for the organization. Uses the GitHub REST/GraphQL API through gh api (read-only). The repository comes from GH_REPO or the current git checkout (gh's {owner}/{repo} resolution, GH_HOST for GitHub Enterprise Server); the organization comes from GH_ORG (default: the repository owner). Fails when gh is missing or unauthenticated (gh auth login or GH_TOKEN); organization settings and branch protection need an owner/admin token.

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

command -v gh >/dev/null 2>&1 || exit 1
gh auth status >/dev/null 2>&1 || exit 1
O=${GH_ORG:-$(gh api 'repos/{owner}/{repo}' --jq .owner.login 2>/dev/null)}
[ -n "$O" ] || exit 1
v=$(gh api "orgs/$O" --jq '.two_factor_requirement_enabled == true' 2>/dev/null) || exit 1
[ "$v" = true ] && echo compliant

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Organization Settings > Authentication security > Require two-factor authentication for everyone in your organization.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: githubsource-code
Tham chiếu: CIS GitHub Benchmark v1.2.0 - 1.3.5 Ensure the organization is requiring members to use Multi- Factor Authentication (MFA)

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target github --level 2