Information
Authentication for administrative (privileged level) access to the device is required at all times. An account is created on the device's local database for use when the authentication server is down or connectivity between the device and the authentication server is not operable. This account is referred to as the account of last resort since it is intended to be used as a last resort and when immediate administrative access is absolutely necessary.
The account of last resort logon credentials must be stored in a sealed envelope and kept in a safe. The safe must be periodically audited to verify the envelope remains sealed. The signature of the auditor and the date of the audit must be added to the envelope as a record. Administrators must secure the credentials and disable access to the root account (if possible) when not needed for system administration functions.
Junos does not have default passwords, and the root account cannot be renamed or disabled. The root account password must be saved in the same manner as the account of last resort.
Solution
Configure the Juniper EX to only allow one local account for use as the account of last resort.
1. Enter configuration mode.
2. Configure the authorized account with an authentication stanza.
3. Configure the authentication order to prefer external AAA.
4. Configure SSH to deny root login.
5. Commit the configuration.
user@host> configure
user@host# set system login user <account of last resort username> authentication plain-text-password
New password: <PW not echoed to screen>
Retype new password: <PW confirmation not echoed to screen>
user@host# delete system login user <not account of last resort username> authentication
user@host# delete system services ssh root-login
--or--
user@host# set system services ssh root-login deny
user@host# set system authentication-order [ <external AAA> password ]
--or--
user@host# set system authentication-order <external AAA>
user@host# commit