JUSX-DM-000110 - The Juniper SRX Services Gateway must authenticate NTP servers before establishing a network connection using bidirectional authentication that is cryptographically based.

Information

Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. Bidirectional authentication provides stronger safeguards to validate the identity of other devices for connections that are of greater risk, such as remote connections.

The Juniper SRX can only be configured to use MD5 authentication keys. This algorithm is not FIPS 140-2 validated; thus, a CAT 1 finding is allocated in CCI-000803. However, MD5 is preferred to no authentication at all.

The trusted-key statement permits authenticating NTP servers. The Juniper SRX supports multiple keys, multiple NTP servers, and different keys for each server; add the 'key <key number>' parameter to the server statement to associate a key with a specific server.

Solution

The Juniper SRX can only be configured to use MD5 authentication keys. This algorithm is not FIPS 140-2 validated; therefore, it violates CCI-000803, which is a CAT 1. However, MD5 is preferred to no authentication at all. The following commands configure the Juniper SRX to use MD5 authentication keys.

set system ntp authentication-key 1 type md5
set system ntp authentication-key 1 value '$9$EgfcrvX7VY4ZEcwgoHjkP5REyv87'
set system ntp authentication-key 2 type md5
set system ntp authentication-key 2 value 'kP5$EgvVfcrwgoY4X7ZEcH$9j RExz50'
set system ntp server <NTP_server_IP> key 1
set system ntp server <NTP_server_IP> prefer
set system ntp server <NTP_server_IP> key 2
set system ntp trusted-key 1
set system ntp trusted-key 2

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_SRX_SG_Y24M07_STIG.zip

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-3(1), CAT|II, CCI|CCI-001967, Rule-ID|SV-223210r961506_rule, STIG-ID|JUSX-DM-000110, STIG-Legacy|SV-80991, STIG-Legacy|V-66501, Vuln-ID|V-223210

Plugin: Juniper

Control ID: d6040a8c250dfe95cae89cef63f0711a91e350a67b86ba74c554f27d755fddc2