TMA-FORTISWITCH-1.7.1.1.7

Ensure default Admin ports are changed

中级别 1自动化fortiswitch

说明

FortiGate admin ports listen on the common ports of 80 and 443. This is default behavior. While interface access is controlled by configuring network interfaces, the FortiGate still listens on the admin ports that have been configured, which can also cause a conflict should 80 or 443 be needed as part of additional configuration later on. FAILs if the HTTP/HTTPS/SSH administrative ports are still the defaults (80, 443, 22); the CIS text uses FortiGate syntax (admin-port/admin-sport), FortiSwitchOS uses system web http-port/https-port. Audited against FortiSwitchOS 'show full-configuration' output (standalone FortiSwitch, saved in full); patterns are scoped to the named 'config ... end' block, whose member lines are indented.

检查方式

审计方法: 配置正则匹配

匹配模式: (?m)(?:^config system global\n(?:[ \t]+[^\n]*\n)*?[ \t]+set admin-(?:port 80|sport 443|ssh-port 22)[ \t]*$|^config system web\n(?:[ \t]+[^\n]*\n)*?[ \t]+set http(?:s-port 443|-port 80)[ \t]*$)

修复方式

修复方法: 操作指南或基础设施补丁

config system global set admin-ssh-port 4422 end config system web set http-port 8082 set https-port 4443 end # CIS guidance: config system global set admin-https-redirect disable set admin-port 8082 **(or any other uncommon port)** set admin-server-cert "self-sign" set admin-sport 4343 **(or any other uncommon port)** end OR From Web GUI: 1. System > Settings 2. Change the ports/settings under 'Administration Settings' section. NOTE: https redirection must be turned off as well as changing port 80. This is due to the nature of how browser port redirection works. The browser will be redirected from port 80 to port 443 or whichever 'admin-sport' is configured, meaning that it will still listen on port 80 even when the port has been reconfigured.

属性

操作系统: 任意
标签: fortiswitchauthentication
参考: CIS FortiSwitch Benchmark v1.0.0 - 1.7.1.1.7 Ensure default Admin ports are changed

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target fortiswitch