← Back to Juniper SRX SG NDM Security Technical Implementation Guide

V-66527

CAT II (Medium)

For local accounts using password authentication (i.e., the root account and the account of last resort) the Juniper SRX Services Gateway must use the SHA1 or later protocol for password authentication.

Rule ID

SV-81017r1_rule

STIG

Juniper SRX SG NDM Security Technical Implementation Guide

Version

V1R3

CCIs

CCI-000197

Discussion

Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. The password format command is an optional command that specifies the hash algorithm used for authenticating passwords. The options are MD5, SHA1, or DES. SHA1 is recommended because it is a FIPS-approved algorithm and provides stronger security.

Check Content

Verify the default local password enforces this requirement by entering the following in configuration mode.

[edit]
show system login password

If the password format is not set to SHA-1, this is a finding.

Fix Text

Enter the configuration mode on the Juniper SRX, set the password option for the local user account of last resort using the following command. 

[edit]
set system login password format sha1