Ensure the Embedded Web Server is accessible over HTTPS only with modern TLS

CaoCấp 1Xem xét thủ côngprinter

Mô tả

Admin credentials and device configuration are exchanged with the EWS; plain HTTP exposes them on the network. Use a trusted certificate, TLS 1.2+ and redirect or disable HTTP.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

In the Embedded Web Server (EWS: browse to https://<printer-ip>/ and sign in as administrator; HP: Security / Networking tabs, Xerox: Properties > Security / Connectivity, Ricoh: Device Management > Configuration, Canon: Settings/Registration > Network Settings / Security Settings) > Security / Networking > Mgmt. Protocols or SSL/TLS settings: 'Encrypt all web communication' / 'Force HTTPS redirect' ON (http://<printer-ip>/ must redirect to https or be refused); TLS 1.0/1.1 and SSL 3.0 disabled, only TLS 1.2/1.3 with strong ciphers; the device certificate is issued by the organisation CA (not the factory self-signed one) and not expired. IPP should be IPPS (port 443/631 TLS) where clients support it.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

EWS: install a CA-signed device certificate (Certificate Management), enable 'Encrypt all web communication' / HTTPS redirect, set minimum TLS version 1.2 and disable weak ciphers; disable plain HTTP and IPP where possible.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: printertlsweb-management
Tham chiếu: CIS Multi-Function Device Benchmark v1.0.0 - Encrypt management traffic (HTTPS) (verify section number for your release)