STIGQter: STIG Summary: Juniper SRX Services Gateway NDM Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 30 Jan 2025:

The Juniper SRX Services Gateway must implement logon roles to ensure only authorized roles are allowed to install software and updates.

DISA Rule

SV-223202r1015750_rule

Vulnerability Number

V-223202

Group Title

SRG-APP-000378-NDM-000302

Rule Version

JUSX-DM-000077

Severity

CAT II

CCI(s)

CCI-003980 - Allow user installation of software only with explicit privileged status.

Weight

Fix Recommendation

Configure the Juniper SRX to allow only the information system security manager (ISSM) user account (or administrators/roles appointed by the ISSM) to select which auditable events are to be audited. To ensure this is the case, each ISSM-appointed role on the AAA must be configured for least privilege using the following stanzas for each role.

[edit]
show system login

Use the delete command or retype the command to remove the permission "Maintenance" or "request system software add" from any class that is not authorized to upgrade software on the device. An explicitly Deny for the command "request system software add" can also be used if some Maintenance commands are permitted.

Check Contents

To verify role-based access control has been configured, view the settings for each login class defined.

[edit]
show system login

View all login classes to see which roles are assigned the "Maintenance" or "request system software add" permissions.

If login classes for user roles that are not authorized to install and update software are configured, this is a finding.

The Juniper SRX Services Gateway must implement logon roles to ensure only authorized roles are allowed to install software and updates.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key