STIGQter: STIG Summary: Juniper Router NDM Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 24 Jul 2020:

The Juniper router must be configured to use an authentication server for the purpose of authenticating users prior to granting administrative access.

DISA Rule

SV-101289r1_rule

Vulnerability Number

V-91189

Group Title

SRG-APP-000516-NDM-000336

Rule Version

JUNI-ND-001360

Severity

CAT I

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.
• CCI-000370 - The organization employs automated mechanisms to centrally manage configuration settings for organization-defined information system components.

Weight

10

Fix Recommendation

Step 1: Configure the authentication server as shown in the following example:

[edit system]
set radius-server x.x.x.x secret xxxxxxxxx

Step 2: Configure the authentication order to use the authentication server as primary source for authentication as shown in the following example:

set authentication-order radius

Note: If there is no response from the authentication server, JUNOS will authenticate using a local account as last resort. It is recommended to not configure password at the end of the authentication order, as JUNOS will attempt to authenticate using a local account upon a rejection from the authentication server.

Check Contents

Review the router configuration to verify that the device is configured to use an authentication server as primary source for authentication as shown in the following example:

system {
authentication-order radius;
}
radius-server {
x.x.x.x secret "$8$xYW-dsq.5zF/wYnC"; ## SECRET-DATA
}

If the router is not configured to use an authentication server for the purpose of authenticating users prior to granting administrative access, this is a finding.

Vulnerability Number

V-91189

Documentable

False

Rule Version

JUNI-ND-001360

Severity Override Guidance

Review the router configuration to verify that the device is configured to use an authentication server as primary source for authentication as shown in the following example:

system {
authentication-order radius;
}
radius-server {
x.x.x.x secret "$8$xYW-dsq.5zF/wYnC"; ## SECRET-DATA
}

If the router is not configured to use an authentication server for the purpose of authenticating users prior to granting administrative access, this is a finding.

Check Content Reference

M

Target Key

3381

Comments