The Juniper SRX Services Gateway must be configured to use an authentication server to centrally manage authentication and logon settings for remote and nonlocal access.
DISA Rule
SV-223206r997567_rule
Vulnerability Number
V-223206
Group Title
SRG-APP-000516-NDM-000336
Rule Version
JUSX-DM-000095
Severity
CAT II
CCI(s)
- CCI-000366 - Implement the security configuration settings.
- CCI-000370 - Manage configuration settings for organization-defined system components using organization-defined automated mechanisms.
- CCI-003627 - Disable accounts when the accounts have expired.
- CCI-003628 - Disable accounts when the accounts are no longer associated to a user.
- CCI-003831 - Alert organization-defined personnel or roles upon detection of unauthorized access, modification, or deletion of audit information.
- CCI-004046 - Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
- CCI-004047 - Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that the device meets organization-defined strength of mechanism requirements.
- CCI-004058 - For password-based authentication, maintain a list of commonly used, expected, or compromised passwords on an organization-defined frequency.
- CCI-004059 - For password-based authentication, update the list of passwords on an organization-defined frequency.
- CCI-004060 - For password-based authentication, update the list of passwords when organizational passwords are suspected to have been compromised directly or indirectly.
- CCI-004061 - For password-based authentication, verify when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a).
- CCI-004063 - For password-based authentication, require immediate selection of a new password upon account recovery.
- CCI-004064 - For password-based authentication, allow user selection of long passwords and passphrases, including spaces and all printable characters.
- CCI-004065 - For password-based authentication, employ automated tools to assist the user in selecting strong password authenticators.
- CCI-004068 - For public key-based authentication, implement a local cache of revocation data to support path discovery and validation.
Weight
10
Fix Recommendation
Configure the Juniper SRX to support the use of AAA services to centrally manage user authentication and logon settings. To completely set up AAA authentication, use a user template account (the default name is remote) and specify a system authentication server and an authentication order.
[edit]
set system tacplus-server address <server ipaddress> port 1812 secret <shared secret>
or
[edit]
set system radius-server address <server ipaddress> port 1812 secret <shared secret>
Note: DOD policy is that redundant AAA servers are required to mitigate the risk of a failure of the primary AAA device. Also see CCI-000213 for further details.
Check Contents
Verify the Juniper SRX is configured to support the use of AAA services to centrally manage user authentication and logon settings.
From the CLI operational mode enter:
show system radius-server
or
show system tacplus-server
If the Juniper SRX has not been configured to support the use RADIUS and/or TACACS+ servers to centrally manage authentication and logon settings for remote and nonlocal access, this is a finding.
Vulnerability Number
V-223206
Documentable
False
Rule Version
JUSX-DM-000095
Severity Override Guidance
Verify the Juniper SRX is configured to support the use of AAA services to centrally manage user authentication and logon settings.
From the CLI operational mode enter:
show system radius-server
or
show system tacplus-server
If the Juniper SRX has not been configured to support the use RADIUS and/or TACACS+ servers to centrally manage authentication and logon settings for remote and nonlocal access, this is a finding.
Check Content Reference
M
Target Key
4098
STIGQter: STIG Summary: Juniper SRX Services Gateway NDM Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 30 Jan 2025: