Title

The Juniper EX switch must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable. (Cat II impact)

Discussion

Authentication for administrative (privileged level) access to the device is required at all times. An account is created on the device's local database for use when the authentication server is down or connectivity between the device and the authentication server is not operable. This account is referred to as the account of last resort since it is intended to be used as a last resort and when immediate administrative access is absolutely necessary. The account of last resort logon credentials must be stored in a sealed envelope and kept in a safe. The safe must be periodically audited to verify the envelope remains sealed. The signature of the auditor and the date of the audit should be added to the envelope as a record. Administrators should secure the credentials and disable access to the root account (if possible) when not needed for system administration functions. Junos does not have default passwords and the root account cannot be renamed or disabled. The root account password should be saved in the same manner as the account of last resort. Setting the console port "insecure" prevents direct root login but also prevents password recovery without knowledge of the root password. Verify only a single local account has an authentication stanza. Local accounts without an authentication stanza are "template accounts" and must be externally authenticated. Template accounts must match the logging-in username or a returned Vendor Specific Attribute (VSA) and are used to map permissions (assigned in the login class) to the user. The example given in the Check and Fix assumes a working external authentication server and appropriate authentication order.

Check Content

1. Verify direct root login is disabled until needed. [edit system services ssh] root-login deny; 2. Verify the console port is set to "insecure": [edit system ports] console { log-out-on-disconnect; insecure; } 3. Verify only the designated account of last resort has an authentication stanza. [edit system login] : : user <account of last resort name> { uid 2004; class <class name>; authentication { encrypted-password "$6$0/BgZc6n$BIY..<snip>..vLzjWpYq2D/"; ## SECRET-DATA } } user auditor { uid 2010; class <class name>; } If access is allowed using any local account other than the account of last resort, this is a finding.

Fix Text

1. Disable direct root login: set system services ssh root-login deny set system ports console insecure 2. Configure the account of last resort: set system login user <account of last resort name> class <class name> set system login user <account of last resort name> authentication plain-text-password New password: <password - not echoed to the screen> Retype new password: <password verification - not echoed to the screen> 3. Set all other template accounts: set system login user <template account 1> class <class 1> set system login user <template account 2> class <class 2>

Additional Identifiers

Rule ID: SV-253901r1028865_rule

Vulnerability ID: V-253901

Group Title: SRG-APP-000148-NDM-000346

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.