STIGQter: STIG Summary: Juniper SRX SG NDM Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

For local accounts using password authentication (i.e., the root account and the account of last resort), the Juniper SRX Services Gateway must enforce a minimum 15-character password length.

DISA Rule

SV-223217r513340_rule

Vulnerability Number

V-223217

Group Title

SRG-APP-000164-NDM-000252

Rule Version

JUSX-DM-000128

Severity

CAT II

CCI(s)

• CCI-000205 - The information system enforces minimum password length.

Weight

10

Fix Recommendation

Set the global password option for all accounts created on the Juniper SRX.

[edit]
set system login password minimum-length 15

Note: This setting only enforces the minimum character password length for newly created passwords. The password of the existing account must be changed if it is not already complaint.

To set or change the root user password, in configuration mode enter the following command.

[edit]
set system root-authentication plain-text-password

When prompted, enter the password for the root user.
Retype new password to confirm

To set or change the account of last resort, in configuration mode enter the following command.

[edit]
set system login user <name of the account of last resort> plain-text-password

When prompted, enter the password for the root user.
Retype new password to confirm

Check Contents

Verify the SRX password enforces this complexity requirement. In configuration mode, enter the following command.

[edit]
show system login password

If the minimum password length for local accounts is not set to at least a 15-character length, this is a finding.

Vulnerability Number

V-223217

Documentable

False

Rule Version

JUSX-DM-000128

Severity Override Guidance

Verify the SRX password enforces this complexity requirement. In configuration mode, enter the following command.

[edit]
show system login password

If the minimum password length for local accounts is not set to at least a 15-character length, this is a finding.

Check Content Reference

M

Target Key

4098

Comments