What changed in Juniper EX Series Switches Network Device Management STIG V2R5V2R5 changes

Title

The Juniper EX switch must be configured to limit the number of concurrent management sessions to 10 or an organization-defined value.

Check text

If, based on operational needs, an organization -defined number other than "1" is used, document the value in the System Security Plan (SSP). ViewVerify the SSHconnection servicelimit configurationfor usingall theenabled "showadministrative configurationaccess systemmethods servicesis ssh"1" commandor an organizationally defined value documented in the SSP. SSH example.: user@host> show configuration system services ssh connection-limit 1; rate-limit 1 If the device does not limit the number of concurrent management sessions to "1" or an organization-defined number, this is a finding.

Fix text

EnterConfigure the CLIswitch configurationto modelimit andconnection enterlimits thefor followingall commandsenabled toadministrative setaccess themethods connection-limit to "1" or an organization -defined number.value If,documented basedin onthe operationalSSP. 1. needs,Enter anconfiguration organizationmode. 2. definedConfigure numberenabled otheradministrative thanaccess methods to "1" isor used,an documentorganizationally thedefined value documented in the SSP. 3. Commit the configuration. SSH example limiting connections to 1: user@host> configure Entering configuration mode user@host# set system services ssh connection-limit 1 or user@host# set system services ssh connection-limit &ltdocumented organizationally defined value> user@host# commit commit complete

V-253878 in V2R5

Title

The Juniper EX switch must be configured to off-load audit records onto a different system or media than the system being audited.

Check text

MarkVerify asan notexternal asyslog findingserver if the site has a solution in place to prevent the device from running out of audit storage. Verify the device is configured to send system events to external syslog. IfThe thelowest organizationseverity haslevel, a centralized repository (or repositories) for secure transfer of audit log files"any", verify each log file is configureddebug toand transferwill filesgenerate toa thesignificant appropriatenumber repository.of Each log file must be configured separatelymessages. [edit system syslog] filehost &ltfileltexternal namesyslog address> { any info; archive size &lt65536..1073741824 bytes> files &lt1..1000> transferstructured-intervalformat; &lt5..2880 minutes> start-time "lt&ltyyyy-mm-dd.hh:mm>"lt archive-sitesOnly { "URL"if passwordstructured "hashedformatting PSK" } ## SECRET-DATA } Note: The URL format is: &ltscp|sftp>://&ltusername>@&ltaddress>/&ltpath>.required, Theotherwise trailingevents slashare isrecorded omittedin becausestandard Junos automatically adds that when it appends the filenameformat. host &ltexternal syslog address> { any info; } Note: If using secure file transfer to offload log files, the Juniper device will immediately attempt to connect with the configured protocol, address, and credentials. If successful, Junos will prompt to accept an untrusted public key. If the administrator accepts that key, Junos adds it to [edit security sshtime-known-hosts].format Alternately, configure the trusted public key at [edit security ssh-known-hosts] before configuring automatic file offload.year; If the device does not offload audit records ontoto aan differentexternal systemsyslog or mediaserver, this is a finding.

Fix text

Archiving is not required unless space is limited in the audit server. Configure the network device to offload audit records onto a different system or media than the system being audited. set file &ltfile name> any info set system syslog file &ltfile name> any infohost set system syslog file &ltfile name> archive size &lt65536..1073741824 bytes> set system syslog filehost &ltfileltexternal name> archive files &lt1..1000> set system syslog filehost &ltfileIPv4 name>or archiveIPv6 transfer-interval &lt5..2880 minutes> set system syslog file &ltfile name> archive start-time "&ltyyyy-mm-dd.hh:mm>" set system syslog file &ltfile name> archive archive-sites "&ltscp|sftp>://&ltusername>@&ltrepository address>/&ltpath without trailing slash (/)>" password "&ltPSK>" set system syslog host &ltexternal syslog address> any info

Discussion

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. OffloadingOff-loading is a common process in information systems with limited audit storage capacity. Archiving is not required unless space is limited in the audit server.

V-253937 in V2R5