Ensure management access to the device is restricted from selected IP addresses and disable from WAN Zone

CaoCấp 1Xem xét thủ côngsophos

Mô tả

It is recommended to limit exposure of Firewall administration services from WAN/untrusted zone. When necessary, leverage on remote VPN or limiting only from selected IP addresses, or use of Sophos Central for firewall administration. For additional security control - RBAC and administrative accounts can be enabled with 2-factor authentication using built-in RADIUS Server. By disabling ‘HTTPS', ‘SSH' and ‘Network services (PING/PING6, DNS, SMTP RELAY, SNMP)' on WAN zone to protect against reconnaissance attempts, network scanners and potential adversary. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

Navigate to 'System > Administration > Device Access > Local service ACL'. Verify 'HTTPS,SSH,PING/PING6,DNS,SMTP RELAY, SNMP' on 'WAN Zone' is unchecked. Navigate to 'Local service ACL exception rule'. Verify that 'Added exception rule' only allows limited IP addresses for device management.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Navigate to 'System > Administration > Device Access > Local service ACL'. Uncheck 'HTTPS,SSH,PING/PING6,DNS,SMTP RELAY, SNMP' on 'WAN Zone'.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: sophosfirewall-policy
Tham chiếu: CIS Sophos Firewall v22 Benchmark v1.0.0 - 1.1.6 Ensure management access to the device is restricted from selected IP addresses and disable from WAN Zone