Script to run the CIS Check Point Firewall Benchmark v1.1.0

[Danny]

🏆 Fastest CIS benchmark score!
✔️ Works on all Gaia systems, can be easily automated!
👉 Todo: Add PSQL checks on security managements

CIS benchmark checks for Gaia OS with score calculation.
Just run the attached bash script in expert mode. 

CIS Benchmark details:

• Latest benchmark version: 1.1.0
  
  • Checklist consists of three parts:
    • Part 1: Password Policy (1.1 - 1.13) Gaia
    • Part 2: Device Setup (2.1.1 - 2.6.3) Gaia
    • Part 3: Firewall Security Settings (3.1 - 3.20) PSQL

Greetings to: @Flo

[the_rock]

Wow Danny, thats AMAZING!

Just ran it in my lab.

[Expert@CP-GW:0]# /var/log/cis/CIS_Benchmark_Gaia_v1.1.0.sh

|-------------------------------------------------------------------------------+
| CIS Benchmark Checks for Check Point Gaia v1.1.0
|-------------------------------------------------------------------------------+
| 1. Password Policy | Score | Status | Value
| 1.1 Password Length 14+ | No | Default | 6
| 1.2 Disallow Palindromes | Yes | Customized | t
| 1.3 Password Complexity 3+ | No | Default | 2
| 1.4 Password History 12+ | No | Default | 10
| 1.5 Password Expiry max. 90 days | No | Default | never
| 1.6 Password Expiry Warning set to 7 | Yes | Customized | 7
| 1.7 Password Expiry Logout set to 1 | No | Default | never
| 1.8 Deny Acces to Used Accounts on | No | Default | off
| 1.9 Non-use days before lockout set to 30 | No | Default | 365
| 1.10 Force to change initial Password | No | Default | no
| 1.11 Deny Access after failed logins on | No | Default | off
| 1.12 Max. Fail-Attempts is set to 5 or lower | No | Default | 10
| 1.13 Down Time set to 300s or more | Yes | Customized | 1200
|-------------------------------------------------------------------------------+
| 2. Device Setup | Score | Status | Value
| 2.1 General Settings | | |
| 2.1.1 Login Banner is set | No | Default | Manually check banner message!
| 2.1.2 Message Of The Day (MOTD) is set | No | Disabled |
| 2.1.3 Core Dump enabled | No | Disabled | | 2.1.4 Config-state is saved | Yes | Default | Saved
| 2.1.5 Unused interfaces are disabled | Yes | - |
| 2.1.6 DNS server is configured | Yes | Customized | [8.8.8.8, 8.8.4.4, 1.1.1.1]
| 2.1.7 IPv6 is disabled (if not in use) | No | Customized |
| 2.1.8 Host Name is set | Yes | Customized | CP-GW
| 2.1.9 Telnet is disabled | Yes | Default | off
| 2.1.10 DHCP is disabled | Yes | Default | Disabled
|----------------------------------------------------------------------------------+
| 2.2 SNMP | Score | Status | Value
| 2.2.1 SNMP Agent is disabled | No | Default | Disabled
| 2.2.2 SNMP Agent version is set to v3-Only | Yes | Customized | v3-Only
| 2.2.3 SNMP traps enabled | No | Default |
| 2.2.4 SNMP traps receivers is set | No | Default |
|----------------------------------------------------------------------------------+
| 2.3 NTP | Score | Status | Value
| 2.3.1.(1) NTP is enabled | No | Default | Disabled
| 2.3.1.(2) NTP Servers (1&2) IPs are configured | Yes | Customized | 2
| 2.3.2 Timezone is set correctly | Yes | Customized | Canada/Eastern
|----------------------------------------------------------------------------------+
| 2.4 Backup | Score | Status | Value
| 2.4.1 System Backup is set | No | Default | Not set
| 2.4.2 Snapshot is set | No | Default | Not set
| 2.4.3 Scheduled Backups | No | - |
|----------------------------------------------------------------------------------+
| 2.5 Authentication Settings | Score | Status | Value
| 2.5.1 CLI Timeout is 10min or less | No | Default | 720 min
| 2.5.2 Web Session Timeout is 10min or less | No | Default | 720 min
| 2.5.3 (1) Telnet Authentication is disabled | Yes | Default | Disabled
| 2.5.3 (2) Client Authentication is SSL secured | No | Default | Insecure HTTP client auth
| 2.5.4 Radius or TACAS+ Server is configured | No | Default | Add Radius or TACACS+ server!
| 2.5.5 Only Allowed Clients for device mgmt | No | Default | Any
|----------------------------------------------------------------------------------+
| 2.6 Logging | Score | Status | Value
| 2.6.1 Mgmtauditlogs is set to on | Yes | Customized | t
| 2.6.2 Auditlog is set to permanent | Yes | Customized | permanent
| 2.6.3 Cplogs is set to on | No | Default | off
|----------------------------------------------------------------------------------+
| Summary: 14 out of 42 checks passed
| CIS Benchmark Score: 33%
+----------------------------------------------------------------------------------+
[Expert@CP-GW:0]#

[the_rock]

Also sent this to few customers Danny, they all LOVED it!

[genisis__]

Awesome Danny!  I ran it on VSX R82, but there where a bunch of interfaces it could not see as I suspect the script may not go into each vs and run per VS.

[Danny]

@genisis__ : Thanks for testing on VSX. As I kept the script code highly readable and adjustable, it should be easy for you to add VSX support and share your result with us. What do you think?

[genisis__]

I've never actually tried it Danny.. not really a coder, but I can try to take a look.

[Daniel_]

Great Script! Thanks!

Is there a bug in 2.3.1 with NTP? I have in /config/active several lines for each NTP Server

# grep -w "^ntp:server:.*\(t\)$"  /config/active
ntp:server:192.0.2.2 t
ntp:server:192.0.2.2:iburst t
ntp:server:192.0.2.1 t
ntp:server:192.0.2.1:iburst t
ntp:server:192.0.2.1:prefer t

This counts the line to 5 and fails.

Version R81.20 take118

[Daniel_]

2.5.4 fails if only radius is configured. The script checks for "aaa:auth_order" but it's "aaa:auth_profile"

# grep aaa:auth_profile /config/active
aaa:auth_profile:base_radius_authprofile:radius_srv:1 t
aaa:auth_profile:base_radius_authprofile:radius_srv:1:host 192.0.2.1
aaa:auth_profile:base_radius_authprofile:radius_srv:1:port 1812
aaa:auth_profile:base_radius_authprofile:radius_srv:1:secret topsecret
aaa:auth_profile:base_radius_authprofile:radius_srv:1:timeout 3
aaa:auth_profile:base_radius_authprofile:radius_srv:2 t
aaa:auth_profile:base_radius_authprofile:radius_srv:2:host 192.0.2.2
aaa:auth_profile:base_radius_authprofile:radius_srv:2:port 1812
aaa:auth_profile:base_radius_authprofile:radius_srv:2:secret topsecret
aaa:auth_profile:base_radius_authprofile:radius_srv:2:timeout 3

[Danny]

Thanks for testing. Please suggest a code fix.

[Hugo_vd_Kooij]

There are a few things that need to be fxed in the CIS benchmark.

I have proposed 1 change allready. But there are some more notes that I have to work on. As a few more thins are not correct in my view.

For example CIS benchmark 2.5.3. makes no sense on machines that are not a gateway.

[Danny]

Yeah, I've seen your proposal here.