Detections
Analytics

JUSX-DM-000098 - The Juniper SRX Services Gateway must specify the order in which authentication servers are used.

Information

Specifying an authentication order implements an authentication, authorization, and accounting methods list to be used, thus allowing the implementation of redundant or backup AAA servers. These commands also ensure that a default method or order will not be used by the device (e.g., local passwords).

The Juniper SRX must specify the order in which authentication is attempted by including the authentication-order statement in the authentication server configuration.

Remote logon using password results in a CAT 1 finding (CCI-000765) for failure to use two-factor authentication. Thus, if the account of last resort uses only password authentication, this configuration prevents remote access. DoD policy is that redundant AAA servers are required to mitigate the risk of a failure of the primary AAA device.

Solution

Add an external RADIUS or TACACS+ server, and specify the port number and shared secret of the server. Remote logon using password results in a CAT 1 finding (CCI-000765) for failure to use two-factor authentication. Thus, if the account of last resort uses only password authentication, this configuration prevents remote access. DoD policy is that redundant AAA servers are required to mitigate the risk of a failure of the primary AAA device.

[edit]
set system authentication-order tacplus

or

[edit]
set system authentication-order radius

From operational mode enter the command:
show system authentication-order

If password is set as an option, remove this command from the configuration.
[edit]
delete system authentication-order password

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_SRX_SG_Y25M01_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6(1), 800-53|CM-6b., CAT|III, CCI|CCI-000366, CCI|CCI-000371, Rule-ID|SV-229026r961863_rule, STIG-ID|JUSX-DM-000098, STIG-Legacy|SV-81087, STIG-Legacy|V-66597, Vuln-ID|V-229026

Plugin: Juniper

Control ID: 22390d816305d905c461c2058c861cf512d964f77c9eff85157fd0cd9bf1873f