STIGQter: STIG Summary: Juniper EX Series Switches Router Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The Juniper router must be configured to have all nonessential capabilities disabled.

DISA Rule

SV-253999r844030_rule

Vulnerability Number

V-253999

Group Title

SRG-NET-000131-RTR-000035

Rule Version

JUEX-RT-000270

Severity

CAT III

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.

Weight

10

Fix Recommendation

Remove unneeded services and functions from the router. For example:

delete system services finger
delete system services ftp
delete system services rlogin
delete system services telnet
delete system services tftp-server
delete system services web-management

For processes that support disable:
set system processes web-management disable

Removal is recommended because the service or function may be inadvertently enabled otherwise.

However, if removal is not possible, disable the service or function.

Check Contents

Review the router configuration to determine if services or functions not required for operation, or not related to router functionality (e.g., DNS, email client or server, FTP server, or web server) are enabled.
By default, unnecessary services like finger, telnet, TFTP and FTP are not enabled and will not be listed at [edit system services].

For example, the following services should NOT be enabled as shown:
[edit system services]
finger;
ftp;
rlogin;
telnet;
tftp-server;
web-management;
Note: If the services listed above are marked "inactive", they are not enabled.

If unnecessary services and functions are enabled on the router, this is a finding.

Vulnerability Number

V-253999

Documentable

False

Rule Version

JUEX-RT-000270

Severity Override Guidance

Review the router configuration to determine if services or functions not required for operation, or not related to router functionality (e.g., DNS, email client or server, FTP server, or web server) are enabled.
By default, unnecessary services like finger, telnet, TFTP and FTP are not enabled and will not be listed at [edit system services].

For example, the following services should NOT be enabled as shown:
[edit system services]
finger;
ftp;
rlogin;
telnet;
tftp-server;
web-management;
Note: If the services listed above are marked "inactive", they are not enabled.

If unnecessary services and functions are enabled on the router, this is a finding.

Check Content Reference

M

Target Key

5479