What changed in Juniper SRX Services Gateway NDM STIG V3R3V3R3 changes

Title

If SNMP is enabled, tThe Juniper SRX Services Gateway must use and securely configure SNMPv3 if SNMP is enabled.

Check text

Verify SNMPv3 is enabled and configured. [edit] show snmp If an SNMP stanza does not exist, this is not a finding. IfVerify SNMPv3 is notenabled configuredand to meet DoD requirements, this is a findingconfigured. [edit] show snmp If versions earlier than SNMPv3 are enabled, this is a finding.

Fix text

Enable and configure SNMPv3 and configure a trap and community string. [edit] set snmp location &ltLOCATION-NAME> set snmp v3 usm local-engine user &ltUSER-NAME> privacy-AES128 authentication-sha256 set snmp v3 vacm security-to-group security-model usm security-name &ltSECURITY-NAME> group &ltGROUP-NAME> set snmp v3 vacm access group &ltGROUP-NAME> default-context-prefix security-model usm security-level privacy read-view all set snmp v3 vacm access group &ltGROUP-NAME> default-context-prefix security-model usm security-level privacy notify-view all set snmp v3 target-address &lttarget-address-name> tag-list &ltSNMP-trap-receiver> set snmp v3 target-address &ltTARGER-ADDRESS-NAME> target-parameters &ltPARMS-NAME> set snmp v3 target-parameters &ltPARMS-NAME> parameters message-processing-model v3 set snmp v3 target-parameters &ltPARMS-NAME> parameters security-model usm set snmp v3 target-parameters &ltPARMS-NAME> parameters security-level privacy set snmp v3 target-parameters &ltPARMS-NAME> parameters security-name &ltSECURITY-NAME> set snmp v3 target-parameters &ltPARMS-NAME> notify-filter device-traps set snmp v3 notify &ltSNMP-TRAPS> type trap set snmp v3 notify &ltSNMP-TRAPS> tag &ltSNMP-TRAP-RECEIVER> set snmp v3 notify-filter device-traps oid jnxChassisTraps include set snmp v3 notify-filter device-traps oid jnxChassisOKTraps include set snmp v3 notify-filter device-traps oid system include set snmp v3 notify-filter device-traps oid .1 include set snmp v3 notify-filter device-traps oid snmpMIBObjects include set snmp engine-id use-mac-address set snmp view all oid .1 include set snmp view all oid system include set snmp view all oid jnxBoxAnatomy include set snmp view all oid snmpMIBObjects include

Discussion

To prevent non-securenonsecure protocol communications with the organization's local SNMPv3 services, the SNMP client on the Juniper SRX must be configured for proper identification and strong cryptographically- based protocol for authentication. SNMPv3 defines a user-based security model (USM), and a view-based access control model (VACM). SNMPv3 USM provides data integrity, data origin authentication, message replay protection, and protection against disclosure of the message payload. SNMPv3 VACM provides access control to determine whether a specific type of access (read or write) to the management information is allowed. The Junos operating system allows the use of SNMPv3 to monitor or query the device for management purposes. Junos does not allow SNMPv3, of any type, to be used to make configuration changes to the device. SNMPv3 is disabled by default and must be enabled for use. SNMPv3 is the DoDDOD-preferred method for monitoring the device securely. If SNMPv3 is not being used, it must be disabled. The following commands in the Fix Text will configure SNMPv3. The Junos operating system allows the use of FIPS approved140-2/140-3 validated protocols for both authentication (SHA1) and for privacy (AES128). These protocols should be used to ensure secure management connections.

CCIs

CCI-000382CCI-000382,CCI-001967

V-223211 in V3R3

Title

ForThe Juniper SRX Services Gateway must use the SHA256 or later protocol for password authentication for local accounts using password authentication (i.e., the root account and the account of last resort) the Juniper SRX Services Gateway must use the SHA1 or later protocol for password authentication.

Severity

mediumhigh

Check text

Verify the default local password enforces this requirement by entering the following in configuration mode. [edit] show system login password If the password format is not set to SHA-1SHA256 or higher, this is a finding.

Fix text

Enter the configurationfollowing modeexample oncommand thefrom Juniper SRX, set the passwordconfiguration option for the local user account of last resort using the following commandmode. [edit] set system login password format sha1sha256

Discussion

Passwords needmust to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. The password format command is an optional command that specifies the hash algorithm used for authenticating passwords. The options are MD5, SHA1, or DES. SHA1 is recommended because it is a FIPS-approved algorithm and provides stronger security.

V-223223 in V3R3

Title

For nonlocal maintenance sessions using SNMP, the Juniper SRX Services Gateway must use and securely configure SNMPv3 with SHASHA256 or higher to protect the integrity of maintenance and diagnostic communications.

Check text

Verify SNMP is configured for version 3. [edit] show snmp v3 If SNMPv3 is not configured for version 3 using SHA256 or higher, this is a finding.

Fix text

Configure snmp to use version 3 with SHA256 authentication. [edit] set snmp v3 usm local-engine user &ltNAME> authentication-sha256

Discussion

Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Nonlocal maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the Internetinternet) or an internal network. The Juniper SRX allows the use of SNMP to monitor or query the device in support of diagnosticsdiagnostic information. SNMP cannot be used to make configuration changes; however, it is a valuable diagnostic tool. SNMP is disabled by default and must be enabled for use. SNMPv3 is the DoDDOD-required version, but must be configured to be used securely.

V-223224 in V3R3

Title

ForThe nonlocal maintenance sessions using SSH, the Juniper SRX Services Gateway must securely configure SSHv2 FIPS 140-2/140-3 validated Keyed-Hash Message Authentication Code (MACHMAC) algorithms to protect the integrity of maintenance and diagnostic communications for nonlocal maintenance sessions.

Severity

mediumhigh

Check text

Verify SSHv2 and MACHMAC algorithms for integrity checking. [edit] show system services ssh If SSHv2 and integrity options are not configured in compliance with DoDDOD requirements for nonlocal maintenance session, this is a finding.

Fix text

Configure SSH integrity options to comply with DoD requirements. [edit] set system services ssh protocol-version v2 set system services ssh macs hmac-sha2-512 set system services ssh macs hmac-sha2-256 set system services ssh macs hmac-sha1 set system services ssh macs hmac-sha1-96

Discussion

To protect the integrity of nonlocal maintenance sessions, SSHv2 with MACHMAC algorithms for integrity checking must be configured. Nonlocal maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the Internetinternet) or an internal network. The SSHv2 protocol suite includes Layer 7 protocols such as SCP and SFTP, which can be used for secure file transfers.

V-223225 in V3R3

Title

ForThe nonlocal maintenance sessions using SNMP, the Juniper SRX Services Gateway must securely configure SNMPv3 with privacy options to protect the confidentiality of nonlocal maintenance and diagnostic communications forusing nonlocal maintenance sessionsSNMP.

Check text

Verify SNMPv3 is configured with privacy options. [edit] show snmp v3 If SNMPv3, AESis encryptionnot configured using AES, and other privacy options are not configured, this is a finding.

Discussion

Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session. Nonlocal maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the Internetinternet) or an internal network. To protect the confidentiality of nonlocal maintenance sessions, SNMPv3 with AES encryption to must be configured to provide confidentiality. The Juniper SRX allows the use of SNMPv3 to monitor or query the device in support of diagnostics information. SNMP cannot be used to make configuration changes; however, it is a valuable diagnostic tool. SNMP is disabled by default and must be enabled for use. SNMPv3 is the DoDDOD-required version, but must be configured to be used securely.

V-223226 in V3R3

Title

ForThe nonlocal maintenance sessions using SSH, the Juniper SRX Services Gateway must securelyuse configured SSHv2 with privacy options to protect the confidentiality of maintenance and diagnostic communications for nonlocal maintenance sessions using SSH.

Severity

mediumhigh

Check text

Verify SSHv2, AES ciphers, and key-exchange commands are configured to protect confidentiality. [edit] show system services ssh If SSHv2, is not configured to use AES ciphers, and key-exchange commands are not configured to protect confidentiality, this is a finding.

Fix text

Configure SSH confidentiality options to comply with DoDDOD requirements. [edit] set system services ssh protocol-version v2 set system services ssh ciphers aes256-ctr set system services ssh ciphers aes256-cbc set system services ssh ciphers aes192-ctr set system services ssh ciphers aes192-cbc set system services ssh ciphers aes128-ctr set system services ssh ciphersmacs aes128hmac-cbc set system services ssh keysha2-exchange dh-group14-sha1512 set system services ssh key-exchangemacs grouphmac-exchange-sha2-256 set system services ssh key-exchange ecdh-sha2-nistp256nistp521 set system services ssh key-exchange ecdh-sha2-nistp384 set system services ssh key-exchange ecdh-sha2-nistp521nistp256

Discussion

To protect the confidentiality of nonlocal maintenance sessions when using SSH communications, SSHv2, AES ciphers, and key-exchange commands are configured. Nonlocal maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the Internetinternet) or an internal network. The SSHv2 protocol suite includes Layer 7 protocols such as SCP and SFTP, which can be used for secure file transfers. The key-exchange commands limit the key exchanges to FIPS and DoDDOD-approved methods.

V-223227 in V3R3