V3R2 changes
Juniper Router NDM STIG V3R2 (2025-01-30) replaced V3R1 (2024-07-24): 10 checks updated. It has 49 checks, against 49 in V3R1.
V3R2 checklistV3R1 checklist Compare V3R1 and V3R2 in STIG Compare
- 0 added
- 0 removed
- 10 updated
Updated fields: CCIs 7Check text 2Fix text 2Discussion 2Title 1
Updated in V3R2 (10)
V-217305CAT IIThe Juniper router must be configured to limit the number of concurrent management sessions to an organization-defined number.Check text, Fix text, Discussion
Check text
Note: This requirement is not applicable to file transfer actions such as SCP and SFTP.
Review the router configuration to determine if concurrent SSH sessions are limited as showshown in the example below:
system {
services {
ssh {
max-sessions-per-connection 13;
connection-limit 23;
}
}
Note: the max-sessions-per-connection must be set to 1 to limit the number of sessions per connection which is limited by the connection-limit.
If the router is not configured to limit the number of concurrent sessions, this is a finding.
Fix text
Configure the router to limit the number of concurrent sessions as shown in the example below:
[edit system services]
set ssh connection-limit 23
set ssh max-sessions-per-connection 13
Discussion
Device management includes the ability to control the number of administrators and management sessions that manage a device. Limiting the number of allowed administrators and sessions per administrator based on account type, role, or access type is helpful in limiting risks related to denial-of-service (DoS) attacks. This requirement addresses concurrent sessions for administrative accounts and does not address concurrent sessions by a single administrator via multiple administrative accounts. The maximum number of concurrent sessions should be defined based upon mission needs and the operational environment for each system. At a minimum, limits must be set for SSH, HTTPS, account of last resort, and root account sessions.
V-217320CAT IThe Juniper router must be configured to prohibit the use of all unnecessary and nonsecure functions and services.Title
Title
The Juniper router must be configured to be configured to prohibit the use of all unnecessary and nonsecure functions and services.
V-217323CAT IIThe Juniper router must be configured to enforce a minimum 15-character password length.CCIs
V-217324CAT IIThe Juniper router must be configured to enforce password complexity by requiring that at least one uppercase character be used.CCIs
V-217325CAT IIThe Juniper router must be configured to enforce password complexity by requiring that at least one lowercase character be used.CCIs
V-217326CAT IIThe Juniper router must be configured to enforce password complexity by requiring that at least one numeric character be used.CCIs
V-217327CAT IIThe Juniper router must be configured to enforce password complexity by requiring that at least one special character be used.CCIs
V-217334CAT IIThe Juniper router must be configured to synchronize its clock with the primary and secondary time sources using redundant authoritative time sources.CCIs
V-217336CAT IIThe Juniper router must be configured to prohibit installation of software without explicit privileged status.CCIs
V-217349CAT IIThe Juniper router must be configured to generate log records for a locally developed list of auditable events.Check text, Fix text, Discussion
Check text
Review the router configuration to verify that it is compliant with this requirement. The example below illustrates how selected events can be logged.
syslog {
file LOG_FILE {
authorization info;
securityany info;
firewall info;
change-log info;
}
}
Note: A syslog server can be configured in lieu of logging to a file as shown in the example below.
system {
syslog {
host x.x.x.x {
authorization info;
securityany info;
firewall info;
change-log info;
}
}
If the router is not configured to generate log records for a locally developed list of auditable events, this is a finding.
Fix text
Configure the router to generate log records for a locally developed list of auditable events as shown in the example below.
[edit system]
set syslog file LOG_FILE authorization info
set syslog file LOG_FILE securityany info
set syslog file LOG_FILE firewall info
set syslog file LOG_FILE change-log info
Note: A syslog server can be configured in lieu of logging to a file as shown in the example below.
set syslog host x.x.x.x authorization info
set syslog host x.x.x.x securityany info
set syslog host x.x.x.x firewall info
set syslog host x.x.x.x change-log info
Discussion
Auditing and logging are key components of any security architecture. Logging the actions of specific events provides a means to investigate an attack;, to recognize resource utilization or capacity thresholds;, or to identify an improperly configured network device. If auditing is not comprehensive, it will not be useful for intrusion monitoring, security investigations, and forensic analysis.
How these changes are found
Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V3R2 no longer has.
Comparing other releases, or this one against an older release? Pick any two in STIG Compare.