← Back to Juniper SRX Services Gateway NDM Security Technical Implementation Guide

V-223227

CAT I (High)

The Juniper SRX Services Gateway must use SSHv2 with privacy options to protect the confidentiality of maintenance and diagnostic communications for nonlocal maintenance sessions using SSH.

Rule ID

SV-223227r1056177_rule

STIG

Juniper SRX Services Gateway NDM Security Technical Implementation Guide

Version

V3R3

CCIs

CCI-003123

Discussion

To protect the confidentiality of nonlocal maintenance sessions when using SSH communications, SSHv2, AES ciphers, and key-exchange commands are configured. Nonlocal maintenance and diagnostic activities are activities conducted by individuals communicating through an external network (e.g., the internet) or internal network. The SSHv2 protocol suite includes Layer 7 protocols such as SCP and SFTP, which can be used for secure file transfers. The key-exchange commands limit the key exchanges to FIPS and DOD-approved methods.

Check Content

Verify SSHv2, AES ciphers, and key-exchange commands are configured to protect confidentiality.

[edit]
show system services ssh

If SSHv2 is not configured to use AES ciphers and key-exchange commands, this is a finding.

Fix Text

Configure SSH confidentiality options to comply with DOD requirements.

[edit]
set system services ssh protocol-version v2
set system services ssh ciphers aes256-ctr
set system services ssh ciphers aes192-ctr
set system services ssh ciphers aes128-ctr
set system services ssh macs hmac-sha2-512
set system services ssh macs hmac-sha2-256
set system services ssh key-exchange ecdh-sha2-nistp521
set system services ssh key-exchange ecdh-sha2-nistp384
set system services ssh key-exchange ecdh-sha2-nistp256