使用 Cnspec 检测 PLCnext Control 过时固件与错误配置

以 Phoenix Contact 基于 ARM Cortex-A9 处理器、含 IEC 61131 运行时系统的 PLCnext Control AXC F 2125 为例。Cnspec 是开源工具，提供不同选项扫描基于 Linux 的 PLCnext Control 检测旧固件和错误配置。本指南提供通过 cnspec SSH 提供程序扫描 PLCnext Control 的分步说明。

1. 在笔记本安装 cnspec（安装指南）

2. 运行以下命令测试连接并建立 cnspec shell 到 PLCnext Control：

   cnspec shell ssh admin@192.168.1.10 --ask-pass 

3. 在 cnspec shell 中执行以下 MQL 命令：

   file("/etc/plcnext/arpversion").content 

可见我们能通过 SSH 连接 PLCnext Control 并执行首个 MQL 命令。

→ loaded configuration from /home/user/.config/mondoo/mondoo.yml using source default Enter password: → discover related assets for 1 asset(s) → resolved assets resolved-assets=1 ___ _ __ ___ _ __ ___ ___ / __| '_ \/ __| '_ \ / _ \/ __| | (__| | | \__ \ |_) | __/ (__ \___|_| |_|___/ .__/ \___|\___| mondoo™ |_| cnspec> file("/etc/plcnext/arpversion").content file.content: "Arpversion: 23.0.0.65 GIT Commit Hash: d755854b5b21ecb8dca26b0a560e6842a0c638d7 Build Job: \"jenkins-PLCnext-Yocto_Targets-Yocto_AXCF2152-release%2F23.0.x-65\" " 

1. 从公共 cnspec-policies 仓库下载 PLCnext Technology 策略执行基础安全检查，运行：

   git clone https://github.com/mondoohq/cnspec-policies Cloning into 'cnspec-policies'... remote: Enumerating objects: 1075, done. remote: Counting objects: 100% (149/149), done. remote: Compressing objects: 100% (84/84), done. remote: Total 1075 (delta 75), reused 115 (delta 61), pack-reused 926 Receiving objects: 100% (1075/1075), 699.81 KiB | 402.00 KiB/s, done. Resolving deltas: 100% (690/690), done. 

2. 运行以下命令通过 SSH 对 PLCnext Control 执行完整安全扫描：

   cnspec scan ssh admin@192.168.1.10 -f cnspec-policies/community/mondoo-phoenix-plcnext-security.mql.yaml --ask-pass 

完整输出如下：

cnspec scan ssh admin@192.168.1.10 -f cnspec-policies/community/mondoo-phoenix-plcnext-security.mql.yaml --ask-pass → loaded configuration from /home/user/.config/mondoo/mondoo.yml using source default Enter password: → using service account credentials → discover related assets for 1 asset(s) → resolved assets resolved-assets=1 axcf2152 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% score: F Asset: axcf2152 --------------- Controls: ✕ Fail: Ensure SSH MaxAuthTries is set to 4 or less ✓ Pass: Ensure secure permissions on SSH public host key files are set ✓ Pass: Ensure only strong MAC algorithms are used ✓ Pass: Ensure only strong ciphers are used ✓ Pass: Ensure SSH IgnoreRhosts is enabled ✓ Pass: Ensure SSH Idle Timeout Interval is configured ✕ Fail: Ensure SSH password authentication is disabled ✓ Pass: Ensure current system time is synchronized ✓ Pass: Ensure only strong Key Exchange algorithms are used ✓ Pass: Ensure SSH LoginGraceTime is set to one minute or less ✓ Pass: Ensure SSH Protocol is set to 2 ✓ Pass: Ensure SSH root login is disabled or set to prohibit-password ✓ Pass: Ensure SSH LogLevel is appropriate ✓ Pass: Ensure SSH PermitUserEnvironment is disabled ✓ Pass: Ensure SSH HostbasedAuthentication is disabled ✓ Pass: Ensure SSH access is limited ✓ Pass: Ensure secure permissions on SSH private host key files are set ✓ Pass: Ensure SSH warning banner is configured ✕ Fail: Ensure Firewall is active ✓ Pass: Ensure SSH PermitEmptyPasswords is disabled ✓ Pass: Ensure SSH X11 forwarding is disabled ✓ Pass: Ensure latest PLCnext Firmware is installed Scanned 1 assets For detailed output, run this scan with "-o full". 

开源 cnspec 安全解决方案提供跨 IT 和 OT 系统识别漏洞和错误配置的综合方法。定期扫描系统可主动发现并修复潜在安全问题，防患未然。

注意：

Makers Blog 展示社区成员应用和用户故事，未经 Phoenix Contact 测试或审核。使用风险自负。