STIGQter STIGQter: STIG Summary: Juniper EX Series Switches Network Device Management Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Juniper EX switch must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable.

DISA Rule

SV-253901r1082953_rule

Vulnerability Number

V-253901

Group Title

SRG-APP-000148-NDM-000346

Rule Version

JUEX-NM-000240

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the Juniper EX to only allow one local account for use as the account of last resort.
1. Enter configuration mode.
2. Configure the authorized account with an authentication stanza.
3. Configure the authentication order to prefer external AAA.
4. Configure SSH to deny root login.
5. Commit the configuration.
user@host> configure
user@host# set system login user <account of last resort username> authentication plain-text-password
New password: <PW not echoed to screen>
Retype new password: <PW confirmation not echoed to screen>

user@host# delete system login user <not account of last resort username> authentication
user@host# delete system services ssh root-login
--or--
user@host# set system services ssh root-login deny
user@host# set system authentication-order [ <external AAA> password ]
--or--
user@host# set system authentication-order <external AAA>
user@host# commit

Check Contents

1. Review the Juniper EX configuration to determine if an account of last resort is configured.
2. Verify the username and password for the root account, and the account of last resort is contained within sealed envelopes and kept in a safe.
Junos categorizes user accounts as "local" or "template", with the difference being the presence of an authentication stanza. Accounts with an authentication stanza are local because the administrator can log in without the need for an external AAA service. Accounts without an authentication stanza are templates that require external authentication. Verify only authorized account(s) have an authentication stanza.
user@host> show configuration system login
...
user <name> {
... <<< No authentication stanza for externally authenticated accounts
}
user <account of last resort username> {
...
authentication {
encrypted-password <password hash>;
}
}

The authentication order must be configured to prefer external AAA, and "password" authentication can be omitted if required. If "password" is present, Junos will attempt password authentication upon external AAA authentication failure. This feature is useful if the account of last resort is required while external AAA remains reachable but is misconfigured and prevents successful logon. If "password" is not present, Junos will not fail over to local authentication unless there is a loss of connectivity with the external AAA service (e.g., timeout).

Verify the authentication order prefers external AAA (first in the order).
user@host> show configuration system authentication-order
authentication-order [ <external AAA> password ]
--or--
authentication-order <external AAA>;

Verify that direct root logon is disabled.
user@host> show configuration system services ssh
<<< missing root-login directive inherits the default 'deny'
protocol-version v2;
...<snip>...
--or--
root-login deny;
...<snip>...

If one local account does not exist for use as the account of last resort, this is a finding.

Vulnerability Number

V-253901

Documentable

False

Rule Version

JUEX-NM-000240

Severity Override Guidance

1. Review the Juniper EX configuration to determine if an account of last resort is configured.
2. Verify the username and password for the root account, and the account of last resort is contained within sealed envelopes and kept in a safe.
Junos categorizes user accounts as "local" or "template", with the difference being the presence of an authentication stanza. Accounts with an authentication stanza are local because the administrator can log in without the need for an external AAA service. Accounts without an authentication stanza are templates that require external authentication. Verify only authorized account(s) have an authentication stanza.
user@host> show configuration system login
...
user <name> {
... <<< No authentication stanza for externally authenticated accounts
}
user <account of last resort username> {
...
authentication {
encrypted-password <password hash>;
}
}

The authentication order must be configured to prefer external AAA, and "password" authentication can be omitted if required. If "password" is present, Junos will attempt password authentication upon external AAA authentication failure. This feature is useful if the account of last resort is required while external AAA remains reachable but is misconfigured and prevents successful logon. If "password" is not present, Junos will not fail over to local authentication unless there is a loss of connectivity with the external AAA service (e.g., timeout).

Verify the authentication order prefers external AAA (first in the order).
user@host> show configuration system authentication-order
authentication-order [ <external AAA> password ]
--or--
authentication-order <external AAA>;

Verify that direct root logon is disabled.
user@host> show configuration system services ssh
<<< missing root-login directive inherits the default 'deny'
protocol-version v2;
...<snip>...
--or--
root-login deny;
...<snip>...

If one local account does not exist for use as the account of last resort, this is a finding.

Check Content Reference

M

Target Key

5477