STIGQter: STIG Summary: Juniper EX Series Switches Network Device Management Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Juniper EX switch must be configured to automatically audit account creation.

DISA Rule

SV-253879r960777_rule

Vulnerability Number

V-253879

Group Title

SRG-APP-000026-NDM-000208

Rule Version

JUEX-NM-000020

Severity

CAT II

CCI(s)

• CCI-000018 - Automatically audit account creation actions.

Weight

10

Fix Recommendation

Configure the network device or its associated authentication server to automatically audit the creation of accounts.

set system syslog host <IPv4 or IPv6 syslog address> change-log info
set system syslog host <IPv4 or IPv6 syslog address> interactive-commands info
-or-
set system syslog host <IPv4 or IPv6 syslog address> any info

Also set the syslog file configuration as follows:

set system syslog file <file name> change-log info
set system syslog file <file name> interactive-commands info
-or-
set system syslog file <file name> any info

Check Contents

Review the network device configuration to determine if it automatically audits account creation or is configured to use an authentication server that would perform this function.

Verify the system logs the facility "any", or minimally "change-log" and "interactive-commands", and the logging level is appropriate. Generally, the "all" (debug) logging level should be avoided because the number of logged messages is significant.

[edit system syslog]
host <IPv4 or IPv6 syslog address> {
any info;
}
file <file name> {
change-log info;
interactive-commands info;
}
Note: If minimally logging only configuration changes, there will be other files receiving the events from the other logging facilities (e.g., "authorizations" or "firewall").

Syslog outputs in standard format unless the "structured-data" directive is configured. Verify the "structured-data" command for all files and external syslog servers requiring that format. For example:

[edit system syslog]
host <IPv4 or IPv6 syslog address> {
change-log info;
interactive-commands info;
structured-data;
}
file <file name> {
any info;
structured-data;
}

If account creation is not automatically audited, this is a finding.

Vulnerability Number

V-253879

Documentable

False

Rule Version

JUEX-NM-000020

Severity Override Guidance

Review the network device configuration to determine if it automatically audits account creation or is configured to use an authentication server that would perform this function.

Verify the system logs the facility "any", or minimally "change-log" and "interactive-commands", and the logging level is appropriate. Generally, the "all" (debug) logging level should be avoided because the number of logged messages is significant.

[edit system syslog]
host <IPv4 or IPv6 syslog address> {
any info;
}
file <file name> {
change-log info;
interactive-commands info;
}
Note: If minimally logging only configuration changes, there will be other files receiving the events from the other logging facilities (e.g., "authorizations" or "firewall").

Syslog outputs in standard format unless the "structured-data" directive is configured. Verify the "structured-data" command for all files and external syslog servers requiring that format. For example:

[edit system syslog]
host <IPv4 or IPv6 syslog address> {
change-log info;
interactive-commands info;
structured-data;
}
file <file name> {
any info;
structured-data;
}

If account creation is not automatically audited, this is a finding.

Check Content Reference

M

Target Key

5477