JUNI-ND-001460 - The Juniper router must be configured with a master password that is used to generate encrypted keys for shared secrets.


By default, shared secrets in a Junos configuration only use an obfuscation algorithm ($9$ format), which is not very strong and can easily be decrypted. Strong encryption for configured secrets can be enabled by configuring a master password to be used as input to the password based key derivation function (PBKDF2) to generate an encryption key. The key is used as input to the Advanced Encryption Standard in Galois/Counter Mode (AES256-GCM).

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.


Configure the master password to be used to generate encrypted keys for shared secrets as shown in the example below.

set system master-password plain-text-password
Master password: xxxxxxxxxx
Repeat master password: xxxxxxxxxx

See Also


Item Details


References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-220142r879887_rule, STIG-ID|JUNI-ND-001460, STIG-Legacy|SV-101299, STIG-Legacy|V-91199, Vuln-ID|V-220142

Plugin: Juniper

Control ID: f4d9e7e99512aa64aa6f1076e52c26abb17d6544e31a6195f263e78519b61c9e