Detections
Analytics
JUEX-NM-000240 - The Juniper EX switch must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable.
Information
Authentication for administrative (privileged level) access to the device is required at all times. An account is created on the device's local database for use when the authentication server is down or connectivity between the device and the authentication server is not operable. This account is referred to as the account of last resort since it is intended to be used as a last resort and when immediate administrative access is absolutely necessary.The account of last resort logon credentials must be stored in a sealed envelope and kept in a safe. The safe must be periodically audited to verify the envelope remains sealed. The signature of the auditor and the date of the audit should be added to the envelope as a record. Administrators should secure the credentials and disable access to the root account (if possible) when not needed for system administration functions.
Junos does not have default passwords and the root account cannot be renamed or disabled. The root account password should be saved in the same manner as the account of last resort. Setting the console port 'insecure' prevents direct root login but also prevents password recovery without knowledge of the root password. Verify only a single local account has an authentication stanza. Local accounts without an authentication stanza are 'template accounts' and must be externally authenticated. Template accounts must match the logging-in username or a returned Vendor Specific Attribute (VSA) and are used to map permissions (assigned in the login class) to the user. The example given in the Check and Fix assumes a working external authentication server and appropriate authentication order.
Solution
1. Disable direct root login:set system services ssh root-login deny
set system ports console insecure
2. Configure the account of last resort:
set system login user <account of last resort name> class <class name>
set system login user <account of last resort name> authentication plain-text-password
New password: <password - not echoed to the screen>
Retype new password: <password verification - not echoed to the screen>
3. Set all other template accounts:
set system login user <template account 1> class <class 1>
set system login user <template account 2> class <class 2>
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_EX_Switches_Y24M10_STIG.zip
Item Details
Category: ACCESS CONTROL
References: 800-53|AC-2(7)(a), 800-53|AC-2a., CAT|II, CCI|CCI-001358, CCI|CCI-002111, Rule-ID|SV-253901r1028865_rule, STIG-ID|JUEX-NM-000240, Vuln-ID|V-253901
Plugin: Juniper
Control ID: 8b95fa665b43c07a7b9665a81e24ecf3a78930206f9a753a59ebddfe0205cc2c