Ensure only SNMPv3 is enabled

检查方式

审计方法: 配置正则匹配

匹配模式

(?ms)^config system snmp sysinfo\n(?:[ \t]+[^\n]*\n)*?[ \t]+set status enable[ \t]*\n.*?^config system snmp community\nend[ \t]*$.*?^config system snmp user\n[ \t]+edit

修复方式

修复方法: 操作指南或基础设施补丁

config system snmp sysinfo set status enable end config system snmp community delete <id> end config system snmp user edit "snmp_v3" set security-level auth-priv set auth-proto sha256 set auth-pwd <password> set priv-proto aes256 set priv-pwd <password> next end # CIS guidance: To enable SNMP agent in CLI: config system snmp sysinfo set status enable end In GUI, go to System > Config > SNMP > Settings and enable SNMP Agent. To delete SNMPv1/2c communities. In this example, we'll delete community "public" in CLI: First, to identify the community, run config system snmp community show config system snmp community edit 1 set name "public" config hosts edit 1 next end next end This shows that the community public has ID 1 config system snmp community delete 1 end In the GUI, go to: System > Config > SNMP > Communities, select the community and click on the Delete button. To add SNMPv3 user in CLI: config system snmp user edit "snmp_test" set security-level auth-priv set auth-proto sha256 set auth-pwd xxxx set priv-proto aes256 set priv_pwd xxxx end In the GUI, go to: 1. System > Config > SNMP > Users, under SNMPv3, click on "Add User" button. 2. Fill in the "Username" field. 3. Assign "SNMP Notify" hosts by clicking on the "+" button. 4. Set the "Security Level" to "Authentication and Privacy". 5. For "Authentication" choose SHA512 as Authentication Protocol. 6. Create a "Password" in the password field. 7. For "Privacy", choose AES256 as Encryption Protocol. 8. Create a "Password" in the password field. 9. Click "Add" to add the new user.

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

tmaegis scan --target fortiswitch