This page will contain notes on securing a Juniper JunOS device. Based on DISA STIG for Juniper Junos. Detail STIG requirements can be found at http://iase.disa.mil/stigs/net_perimeter/network_infra/routers_switches.html - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - JUNP-1001 (NET0400) command used to set OSPF authenticationRelated to DISA STIG NET0400 - Interior routing protocols are not authenticated. set protocols ospf area 0.0.0.0 interface em0.0 authentication md5 1 key "$9$FYPx3tOylMWxdWLkPfQCAxNdV4Z.PQz6Az3vLXN2g69AtIcWLN" JUNP-1002 (NET-IPV6-059) command used to set IPv6 Maximum hopsRelated to DISA STIG NET-IPV6-059 Maximum hop limit is less than 32. set protocols router-advertisement interface em0.0 max-advertisement-interval 32 JUNP-1003 (NET-IPV6-034) command used to set uRFPRelated to DISA STIG NET-IPV6-034 - IPv6 Egress Outbound Spoofing Filter
set routing-options forwarding-table unicast-reverse-path active-paths JUNP-1004 (NET-IPV6-025) command used to delete IPv6 address on an interfaceRelated to DISA STIG NET-IPV6-025 - IPv6 Site Local Unicast ADDR must not be defined. delete interfaces em0 unit 0 family inet6 address FFC0::1/10 JUNP-1005 (NET0340) command used to display the banner page during logins.Related to DISA STIG NET0340 - Login banner is non-existent or not DOD approved. set system login message "test banner page" JUNP-1006 (NET1647) command used to set SSH version.Related to DISA STIG NET1647 - The network element must not allow SSH Version 1. set system services ssh protocol-version v2 JUNP-1007 (NET1646) command used to set the login attempts.Related to DISA STIG NET1646 - SSH login attempts value is greater than 3. set system login retry-options tries-before-disconnect 3 JUNP-1008 (NET0580) command used to enable authentication on the diagnostic port.Related to DISA STIG NET0580 - Password required on the JUNOS diagnostic port. set system diag-port-authentication plain-text-password For auditing purposes check the configuration for "encrypted-password"system { diag-port-authentication { encrypted-password "$1$86g42opl$aoQ8ZkzJ6YvUryTq9YJWd/"; ## SECRET-DATA } JUNP-1009 (NET-1645) command used to configure session timeout.Related to DISA STIG NET-1645 SSH session timeout is not 60 seconds or less. set x x |
Home >