STIGQter STIGQter: STIG Summary: Juniper SRX Services Gateway NDM Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 30 Jan 2025:

The Juniper SRX Services Gateway must use SSHv2 with privacy options to protect the confidentiality of maintenance and diagnostic communications for nonlocal maintenance sessions using SSH.

DISA Rule

SV-223227r1056177_rule

Vulnerability Number

V-223227

Group Title

SRG-APP-000412-NDM-000331

Rule Version

JUSX-DM-000150

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

Configure SSH confidentiality options to comply with DOD requirements.

[edit]
set system services ssh protocol-version v2
set system services ssh ciphers aes256-ctr
set system services ssh ciphers aes192-ctr
set system services ssh ciphers aes128-ctr
set system services ssh macs hmac-sha2-512
set system services ssh macs hmac-sha2-256
set system services ssh key-exchange ecdh-sha2-nistp521
set system services ssh key-exchange ecdh-sha2-nistp384
set system services ssh key-exchange ecdh-sha2-nistp256

Check Contents

Verify SSHv2, AES ciphers, and key-exchange commands are configured to protect confidentiality.

[edit]
show system services ssh

If SSHv2 is not configured to use AES ciphers and key-exchange commands, this is a finding.

Vulnerability Number

V-223227

Documentable

False

Rule Version

JUSX-DM-000150

Severity Override Guidance

Verify SSHv2, AES ciphers, and key-exchange commands are configured to protect confidentiality.

[edit]
show system services ssh

If SSHv2 is not configured to use AES ciphers and key-exchange commands, this is a finding.

Check Content Reference

M

Target Key

4098