Ensure Radius or TACACS+ server is configured

高级别 1自动化checkpoint

说明

Configured the TACACS-Servers or Radius server for central authentication. PASS requires a RADIUS or TACACS+ server to be defined. Audited against the Gaia clish 'show configuration' output (run 'show configuration' in clish on each gateway and management server and save the full output).

检查方式

审计方法: 配置正则匹配

匹配模式: (?m)^(?:add aaa radius-servers priority \d+ host \S+|add aaa tacacs-servers priority \d+ server \S+)

修复方式

修复方法: 操作指南或基础设施补丁

set aaa tacacs-servers state on add aaa tacacs-servers priority 1 server <IP> key <key> timeout 5 (or) add aaa radius-servers priority 1 host <IP> secret <key> port 1812 timeout 3 save config # CIS guidance: run the following command to enable and add TACACS+ servers. CLI: set aaa tacacs-servers state on add aaa tacacs-servers priority <priority_value> server <IP_Address> key <Key> timeout <timeout_value> GUI: Navigate to User Management > Authentication Servers > TACACS+ configuration > Ensuere Enable TACACS+ authentication is checked Navigate to User Management > Authentication Servers > TACACS+ configuration > Enable TACACS+ Servers > Add Provide <Server_IP_Address>, <Priority> and <Timeout>. Run the following command to enable and add Radius servers. CLI: add aaa radius-servers priority <priority_value> host <IP_Address> secret <Key> port <Port_number> timeout <timeout_value> GUI: Navigate to User Management > Authentication Servers > Radius Servers > Add Provide <Server_IP_Address>, <Priority>, <UDP_Port> and <Timeout>.

属性

操作系统: 任意
标签: checkpointauthentication
参考: CIS Check Point Firewall Benchmark v1.1.0 - 2.5.4 Ensure Radius or TACACS+ server is configured

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target checkpoint