STIGQter: STIG Summary: Juniper Router NDM Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 24 Jul 2020:

The Juniper router must be configured to allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.

DISA Rule

SV-101253r1_rule

Vulnerability Number

V-91153

Group Title

SRG-APP-000357-NDM-000293

Rule Version

JUNI-ND-000970

Severity

CAT II

CCI(s)

• CCI-001849 - The organization allocates audit record storage capacity in accordance with organization-defined audit record storage requirements.

Weight

10

Fix Recommendation

Configure the number or archive files and the maximum size of the active log file to be reached prior to archiving as shown in the example below.

[edit system]
set syslog file LOG_FILE any info
set syslog file LOG_FILE archive files 12 size 1000000

Check Contents

Review the router configuration to verify that it is compliant with this requirement. The configuration example below specifies 12 archive log files and the maximum size of the active log file to be reached prior to archiving.

syslog {
file LOG_FILE {
any info;
archive size 1000000 files 12;
}
}

Note: To prevent log files from growing too large, by default the Junos logging utility writes messages to a sequence of files of a defined size. The files in the sequence are referred to as archive files to distinguish them from the active file to which messages are currently being written. The default maximum size depends on the platform type. By default, the logging utility creates up to 10 archive files in this manner. When the maximum number of archive files is reached and when the size of the active file reaches the configured maximum size, the contents of the last archived file are overwritten by the current active file.

If the router is not configured to allocate audit record storage capacity in accordance with organization-defined audit record storage requirements, this is a finding.

Vulnerability Number

V-91153

Documentable

False

Rule Version

JUNI-ND-000970

Severity Override Guidance

Review the router configuration to verify that it is compliant with this requirement. The configuration example below specifies 12 archive log files and the maximum size of the active log file to be reached prior to archiving.

syslog {
file LOG_FILE {
any info;
archive size 1000000 files 12;
}
}

Note: To prevent log files from growing too large, by default the Junos logging utility writes messages to a sequence of files of a defined size. The files in the sequence are referred to as archive files to distinguish them from the active file to which messages are currently being written. The default maximum size depends on the platform type. By default, the logging utility creates up to 10 archive files in this manner. When the maximum number of archive files is reached and when the size of the active file reaches the configured maximum size, the contents of the last archived file are overwritten by the current active file.

If the router is not configured to allocate audit record storage capacity in accordance with organization-defined audit record storage requirements, this is a finding.

Check Content Reference

M

Target Key

3381

Comments