STIGQter: STIG Summary: Juniper SRX SG NDM Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

The Juniper SRX Services Gateway must specify the order in which authentication servers are used.

DISA Rule

SV-229026r518256_rule

Vulnerability Number

V-229026

Group Title

SRG-APP-000516-NDM-000317

Rule Version

JUSX-DM-000098

Severity

CAT III

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.
• CCI-000371 - The organization employs automated mechanisms to centrally apply configuration settings for organization-defined information system components.

Weight

10

Fix Recommendation

Add an external RADIUS or TACACS+ server, and specify the port number and shared secret of the server. Remote logon using password results in a CAT 1 finding (CCI-000765) for failure to use two-factor authentication. Thus, if the account of last resort uses only password authentication, this configuration prevents remote access. DoD policy is that redundant AAA servers are required to mitigate the risk of a failure of the primary AAA device.

[edit]
set system authentication-order tacplus

or

[edit]
set system authentication-order radius

From operational mode enter the command:
show system authentication-order

If password is set as an option, remove this command from the configuration.
[edit]
delete system authentication-order password

Check Contents

Verify a RADIUS or TACACS+ server order has been configured.

From operational mode enter the command:
show system authentication-order

If the authentication-order for either or both RADIUS or TACACS+ server order has not been configured, this is a finding.

If the authentication-order includes the password method, this is a finding.

Vulnerability Number

V-229026

Documentable

False

Rule Version

JUSX-DM-000098

Severity Override Guidance

Verify a RADIUS or TACACS+ server order has been configured.

From operational mode enter the command:
show system authentication-order

If the authentication-order for either or both RADIUS or TACACS+ server order has not been configured, this is a finding.

If the authentication-order includes the password method, this is a finding.

Check Content Reference

M

Target Key

4098

Comments