JUSX-DM-000113 - The Juniper SRX Services Gateway must ensure access to start a UNIX-level shell is restricted to only the root account.

Information

Restricting the privilege to create a UNIX-level shell limits access to this powerful function. System administrators, regardless of their other permissions, will need to also know the root password for this access, thus limiting the possibility of malicious or accidental circumvention of security controls.

Solution

For each login class, add the following command to the stanza.

[edit]
set system login class <class name> deny-commands '(start shell)'

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_SRX_SG_Y24M07_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7b., CAT|II, CCI|CCI-000382, Rule-ID|SV-223213r960966_rule, STIG-ID|JUSX-DM-000113, STIG-Legacy|SV-80997, STIG-Legacy|V-66507, Vuln-ID|V-223213

Plugin: Juniper

Control ID: 2c4fde1051ae4a933dfea3c21c9873e4cc97213cac2c10f468ce22c0b8b9d707