STIGQter: STIG Summary: Juniper Router NDM Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 24 Jul 2020:

The Juniper router must be configured to implement replay-resistant authentication mechanisms for network access to privileged accounts.

DISA Rule

SV-101229r1_rule

Vulnerability Number

V-91129

Group Title

SRG-APP-000156-NDM-000250

Rule Version

JUNI-ND-000530

Severity

CAT II

CCI(s)

• CCI-001941 - The information system implements replay-resistant authentication mechanisms for network access to privileged accounts.

Weight

10

Fix Recommendation

Configure SSH to use FIPS-140-2 compliant HMACs as shown in the example below.

[edit system services]
set ssh protocol-version v2
set ssh macs [hmac-sha2-256 hmac-sha2-512]

Note: An SSH configuration enables a server and client to authorize the negotiation of only those algorithms that are configured from the allowed list. If a user tries to negotiate using an algorithm that is not part of the allowed list, the request is rejected and the session is not established.

Check Contents

Review the router configuration to verify that SSH is configured to use FIPS-140-2 compliant HMACs as shown in the example below.

system {
…
…
…
services {
ssh {
protocol-version v2;
macs [hmac-sha2-256 hmac-sha2-512];
}

Note: An SSH configuration enables a server and client to authorize the negotiation of only those algorithms that are configured from the allowed list. If a remote party tries to negotiate using an algorithm that is not part of the allowed list, the request is rejected and the session is not established.

If the router is not configured to implement replay-resistant authentication mechanisms for network access to privileged accounts, this is a finding.

Vulnerability Number

V-91129

Documentable

False

Rule Version

JUNI-ND-000530

Severity Override Guidance

Review the router configuration to verify that SSH is configured to use FIPS-140-2 compliant HMACs as shown in the example below.

system {
…
…
…
services {
ssh {
protocol-version v2;
macs [hmac-sha2-256 hmac-sha2-512];
}

Note: An SSH configuration enables a server and client to authorize the negotiation of only those algorithms that are configured from the allowed list. If a remote party tries to negotiate using an algorithm that is not part of the allowed list, the request is rejected and the session is not established.

If the router is not configured to implement replay-resistant authentication mechanisms for network access to privileged accounts, this is a finding.

Check Content Reference

M

Target Key

3381

Comments