STIGQter: STIG Summary: Juniper SRX SG NDM Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

For local accounts, the Juniper SRX Services Gateway must generate an alert message to the management console and generate a log event record that can be forwarded to the ISSO and designated system administrators when local accounts are created.

DISA Rule

SV-229015r518223_rule

Vulnerability Number

V-229015

Group Title

SRG-APP-000516-NDM-000317

Rule Version

JUSX-DM-000019

Severity

CAT II

CCI(s)

• CCI-000171 - The information system allows organization-defined personnel or roles to select which auditable events are to be audited by specific components of the information system.
• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Configure the Juniper SRX to generate and send a notification or log message immediately that can be forwarded via an event monitoring system (e.g., via Syslog configuration, SNMP trap, manned console message, or other events monitoring system). The NSM, Syslog, or SNMP server must then be configured to send the message.

The following commands configure the device to immediately display a message to any currently logged on administrator's console when changes are made to the configuration. This is an example method. Alerts must be sent immediately to the designated individuals (e.g., via Syslog configuration, SNMP trap, manned console message, or other events monitoring system).

[edit]
set system syslog users * change-log <info | any>
set system syslog host <IP-syslog-server> any any
set system syslog file account-actions change-log any any

Check Contents

Verify the device is configured to display change-log events of severity info.

[edit]
show system syslog

If the system is not configured to display account creation actions on the management console and generate an event log message to the Syslog server and a local file, this is a finding.

Vulnerability Number

V-229015

Documentable

False

Rule Version

JUSX-DM-000019

Severity Override Guidance

Verify the device is configured to display change-log events of severity info.

[edit]
show system syslog

If the system is not configured to display account creation actions on the management console and generate an event log message to the Syslog server and a local file, this is a finding.

Check Content Reference

M

Target Key

4098

Comments