JUEX-NM-000240 - The Juniper EX switch must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable.

Information

Authentication for administrative (privileged level) access to the device is required at all times. An account is created on the device's local database for use when the authentication server is down or connectivity between the device and the authentication server is not operable. This account is referred to as the account of last resort since it is intended to be used as a last resort and when immediate administrative access is absolutely necessary.

The account of last resort logon credentials must be stored in a sealed envelope and kept in a safe. The safe must be periodically audited to verify the envelope remains sealed. The signature of the auditor and the date of the audit should be added to the envelope as a record. Administrators should secure the credentials and disable access to the root account (if possible) when not needed for system administration functions.

Solution

Configure the device to only allow one local account for use as the account of last resort.

Disable direct root login:
set system services ssh root-login deny
set system ports console insecure

Configure the account of last resort:
set system login user <account of last resort name> class <class name>
set system login user <account of last resort name> authentication plain-text-password
New password: <password - not echoed to the screen>
Retype new password: <password verification - not echoed to the screen>

Set all other template accounts:
set system login user <template account 1> class <class 1>
set system login user <template account 2> class <class 2>

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_EX_Switches_Y24M07_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2(7)(a), 800-53|AC-2a., CAT|II, CCI|CCI-001358, CCI|CCI-002111, Rule-ID|SV-253901r960969_rule, STIG-ID|JUEX-NM-000240, Vuln-ID|V-253901

Plugin: Juniper

Control ID: c15ea0abe9ebec45a89a5798ac172f2d1d9df44ad4339321e431c7bb0034d91f