STIGQter STIGQter: STIG Summary: Juniper SRX SG NDM Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

For nonlocal maintenance sessions using SSH, the Juniper SRX Services Gateway must securely configured SSHv2 with privacy options to protect the confidentiality of maintenance and diagnostic communications for nonlocal maintenance sessions.

DISA Rule

SV-223227r513370_rule

Vulnerability Number

V-223227

Group Title

SRG-APP-000412-NDM-000331

Rule Version

JUSX-DM-000150

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure SSH confidentiality options to comply with DoD requirements.

[edit]
set system services ssh protocol-version v2
set system services ssh ciphers aes256-ctr
set system services ssh ciphers aes256-cbc
set system services ssh ciphers aes192-ctr
set system services ssh ciphers aes192-cbc
set system services ssh ciphers aes128-ctr
set system services ssh ciphers aes128-cbc
set system services ssh key-exchange dh-group14-sha1
set system services ssh key-exchange group-exchange-sha2
set system services ssh key-exchange ecdh-sha2-nistp256
set system services ssh key-exchange ecdh-sha2-nistp384
set system services ssh key-exchange ecdh-sha2-nistp521

Check Contents

Verify SSHv2, AES ciphers, and key-exchange commands are configured to protect confidentiality.

[edit]
show system services ssh

If SSHv2, AES ciphers, and key-exchange commands are not configured to protect confidentiality, this is a finding.

Vulnerability Number

V-223227

Documentable

False

Rule Version

JUSX-DM-000150

Severity Override Guidance

Verify SSHv2, AES ciphers, and key-exchange commands are configured to protect confidentiality.

[edit]
show system services ssh

If SSHv2, AES ciphers, and key-exchange commands are not configured to protect confidentiality, this is a finding.

Check Content Reference

M

Target Key

4098

Comments