← Back to Juniper SRX Services Gateway NDM Security Technical Implementation Guide

V-223213

CAT II (Medium)

The Juniper SRX Services Gateway must ensure access to start a UNIX-level shell is restricted to only the root account.

Rule ID

SV-223213r1043177_rule

STIG

Juniper SRX Services Gateway NDM Security Technical Implementation Guide

Version

V3R3

CCIs

CCI-000382

Discussion

Restricting the privilege to create a UNIX-level shell limits access to this powerful function. System administrators, regardless of their other permissions, will need to also know the root password for this access, thus limiting the possibility of malicious or accidental circumvention of security controls.

Check Content

Verify each login class is configured to deny access to the UNIX shell.

[edit]
show system login

If each configured login class is not configured to deny access to the UNIX shell, this is a finding.

Fix Text

For each login class, add the following command to the stanza.

[edit]
set system login class <class name> deny-commands "(start shell)"