STIGQter: STIG Summary: Juniper Router NDM Security Technical Implementation Guide Version: 3 Release: 2 Benchmark Date: 30 Jan 2025:

The Juniper router must be configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access.

DISA Rule

SV-217350r961863_rule

Vulnerability Number

V-217350

Group Title

SRG-APP-000516-NDM-000336

Rule Version

JUNI-ND-001360

Severity

CAT I

CCI(s)

• CCI-000370 - Manage configuration settings for organization-defined system components using organization-defined automated mechanisms.

Weight

10

Fix Recommendation

Step 1: Configure the authentication servers as shown in the following example:

[edit system]
set radius-server x.x.x.x secret xxxxxxxxx
set radius-server x.x.x.x secret xxxxxxxxx

Step 2: Configure the authentication order to use the authentication servers as primary source for authentication as shown in the following example:

set authentication-order radius

Note: If there is no response from the authentication server, JUNOS will authenticate using a local account as last resort. It is recommended to not configure the password at the end of the authentication order, as JUNOS will attempt to authenticate using a local account upon a rejection from the authentication server.

Check Contents

Review the router configuration to verify that the device is configured to use at least two authentication servers as primary source for authentication as shown in the following example:

system {
authentication-order radius;
}
radius-server {
x.x.x.x secret "$8$xYW-dsq.5zF/wYnC"; ## SECRET-DATA
}
radius-server {
x.x.x.x secret "$8$xYW-dsq.5zF/wYnC"; ## SECRET-DATA
}

If the router is not configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access, this is a finding.

Vulnerability Number

V-217350

Documentable

False

Rule Version

JUNI-ND-001360

Severity Override Guidance

Review the router configuration to verify that the device is configured to use at least two authentication servers as primary source for authentication as shown in the following example:

system {
authentication-order radius;
}
radius-server {
x.x.x.x secret "$8$xYW-dsq.5zF/wYnC"; ## SECRET-DATA
}
radius-server {
x.x.x.x secret "$8$xYW-dsq.5zF/wYnC"; ## SECRET-DATA
}

If the router is not configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access, this is a finding.

Check Content Reference

M

Target Key

4034