Ensure Client Authentication is secured.

高等級 1人工審核checkpoint

說明

Client Authentication allows a user and device to authenticate to the firewall and inherit pre-configured firewall rules for a set amount of time. By default, these connections are unencrypted yet can travel over unsecured networks. It is recommended that all Client Authentication connections be made using the HTTPS configuration. This both uniquely identifies the gateway and keeps the authentication credentials from being copied when going over the network.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

On the gateway, check $FWDIR/conf/fwauthd.conf in expert mode: the line '259 fwssd in.aclientd wait 259' (Telnet client authentication) must be commented out or absent, and the line '900 fwssd in.ahclientd wait 900' must carry 'ssl:defaultCert' so HTTP client authentication uses HTTPS.

修補方式

修補方法: 操作指南或基礎設施修補檔

Comment out or remove the following line from $FWDIR/conf/fwauthd.conf file, or disable the telnet service listening on port 259 by default, write a rule that prevents connections to the daemon in the rulebase. #259 fwssd in.aclientd wait 259 Edit the following line to include SSL setting in $FWDIR/conf/fwauthd.conf file. 900 fwssd in.ahclientd wait 900 ssl:defaultCert

屬性

作業系統: 不限
標籤: checkpointauthentication
參考資料: CIS Check Point Firewall Benchmark v1.1.0 - 2.5.3 Ensure Client Authentication is secured.