TMA-FORTIGATE-2.2.1

Ensure 'Password Policy' is enabled

高级别 1自动化fortigate

说明

It is important to use secure and complex passwords for preventing unauthorized access to the FortiGate device. PASS requires the password policy enabled, applied to admin-password and minimum-length 14 or more. Audited against FortiOS 'show full-configuration' output (run it from the global context on VDOM-enabled units and save the full output); patterns are scoped to the named 'config ... end' block, whose member lines are indented.

检查方式

审计方法: 配置正则匹配

匹配模式: (?m)^config system password-policy\n(?:(?:[ \t]+[^\n]*\n)*?[ \t]+set status enable[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set apply-to [^\n]*\badmin-password\b[^\n]*[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set minimum-length (?:1[4-9]|[2-9]\d|1[01]\d|12[0-8])[ \t]*$|(?:[ \t]+[^\n]*\n)*?[ \t]+set status enable[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set minimum-length (?:1[4-9]|[2-9]\d|1[01]\d|12[0-8])[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set apply-to [^\n]*\badmin-password\b[^\n]*[ \t]*$|(?:[ \t]+[^\n]*\n)*?[ \t]+set apply-to [^\n]*\badmin-password\b[^\n]*[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set status enable[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set minimum-length (?:1[4-9]|[2-9]\d|1[01]\d|12[0-8])[ \t]*$|(?:[ \t]+[^\n]*\n)*?[ \t]+set apply-to [^\n]*\badmin-password\b[^\n]*[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set minimum-length (?:1[4-9]|[2-9]\d|1[01]\d|12[0-8])[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set status enable[ \t]*$|(?:[ \t]+[^\n]*\n)*?[ \t]+set minimum-length (?:1[4-9]|[2-9]\d|1[01]\d|12[0-8])[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set status enable[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set apply-to [^\n]*\badmin-password\b[^\n]*[ \t]*$|(?:[ \t]+[^\n]*\n)*?[ \t]+set minimum-length (?:1[4-9]|[2-9]\d|1[01]\d|12[0-8])[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set apply-to [^\n]*\badmin-password\b[^\n]*[ \t]*\n(?:[ \t]+[^\n]*\n)*?[ \t]+set status enable[ \t]*$)

修复方式

修复方法: 操作指南或基础设施补丁

config system password-policy set status enable set apply-to admin-password ipsec-preshared-key set minimum-length 14 end # CIS guidance: Can be modified from CLI or GUI. From CLI, do the following: config system password-policy set status enable set apply-to admin-password ipsec-preshared-key set minimum-length 14 end Or from GUI, do the following: 1) Log in to FortiGate as Super Admin 2) Go to 'System' > 'Settings' 3) Find the 'Password Policy' section 4) Default 'Password scope' is 'Off', change it to 'Both' 5) set 'Minimum length' to '14'

属性

操作系统: 任意
标签: fortigateauthentication
参考: CIS FortiGate 7.4.x Benchmark v1.0.1 - 2.2.1 Ensure 'Password Policy' is enabled

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target fortigate