Title

The Juniper router must be configured with a master password that is used to generate encrypted keys for shared secrets. (Cat II impact)

Discussion

By default, shared secrets in a Junos configuration only use an obfuscation algorithm ($9$ format), which is not very strong and can easily be decrypted. Strong encryption for configured secrets can be enabled by configuring a master password to be used as input to the password based key derivation function (PBKDF2) to generate an encryption key. The key is used as input to the Advanced Encryption Standard in Galois/Counter Mode (AES256-GCM).

Check Content

Verify that a master password has been configured as by entering the following command: show configuration system master-password The output will appear as follows: password-configured; Note: The master password is hidden from the configuration. If a master password has not been configured, this is a finding.

Fix Text

Configure the master password to be used to generate encrypted keys for shared secrets as shown in the example below. [edit] set system master-password plain-text-password Master password: xxxxxxxxxx Repeat master password: xxxxxxxxxx

Additional Identifiers

Rule ID: SV-220142r879887_rule

Vulnerability ID: V-220142

Group Title: SRG-APP-000516-NDM-000317

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.