STIGQter: STIG Summary: Symantec ProxySG ALG Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Apr 2020:

Symantec ProxySG, when configured for reverse proxy/WAF services and providing PKI-based user authentication intermediary services, must map the client certificate to the authentication server store.

DISA Rule

SV-104249r1_rule

Vulnerability Number

V-94295

Group Title

SRG-NET-000166-ALG-000101

Rule Version

SYMP-AG-000410

Severity

CAT II

CCI(s)

• CCI-000187 - The information system, for PKI-based authentication, maps the authenticated identity to the account of the individual or group.

Weight

10

Fix Recommendation

Configure the ProxySG to map PKI user credentials to user identities in a reverse proxy configuration.

1. Log on to the Web Management Console.
2. Browse to Configuration >> Services >> Proxy Services.
3. Click each HTTPS Reverse Proxy service and click "Edit Service".
4. Check the "Verify Client" option and click "Apply".
5. Configure all remaining options in accordance with the site's SSP.

Check Contents

Verify that PKI user credentials map identities to the user account name in a reverse proxy configuration.

1. Log on to the Web Management Console.
2. Browse to Configuration >> Services >> Proxy Services.
3. Click each HTTPS Reverse Proxy service and click "Edit Service".
4. Verify that "Verify Client" is checked. Verify that all remaining options are in accordance with the site's SSP.

If Symantec ProxySG, when configured for reverse proxy/WAF services and providing PKI-based user authentication intermediary services, does not map the client certificate to the authentication server store, this is a finding.

Vulnerability Number

V-94295

Documentable

False

Rule Version

SYMP-AG-000410

Severity Override Guidance

Verify that PKI user credentials map identities to the user account name in a reverse proxy configuration.

1. Log on to the Web Management Console.
2. Browse to Configuration >> Services >> Proxy Services.
3. Click each HTTPS Reverse Proxy service and click "Edit Service".
4. Verify that "Verify Client" is checked. Verify that all remaining options are in accordance with the site's SSP.

If Symantec ProxySG, when configured for reverse proxy/WAF services and providing PKI-based user authentication intermediary services, does not map the client certificate to the authentication server store, this is a finding.

Check Content Reference

M

Target Key

3515

Comments