1. Review the Juniper EX configuration to determine if an account of last resort is configured. 2. Verify the username and password for the root account, and the account of last resort is contained within sealed envelopes and kept in a safe. Junos categorizes user accounts as "local" or "template", with the difference being the presence of an authentication stanza. Accounts with an authentication stanza are local because the administrator can log in without the need for an external AAA service. Accounts without an authentication stanza are templates that require external authentication. Verify only authorized account(s) have an authentication stanza. user@host> show configuration system login ... user <name> { ... <<< No authentication stanza for externally authenticated accounts } user <account of last resort username> { ... authentication { encrypted-password <password hash>; } } The authentication order must be configured to prefer external AAA, and "password" authentication can be omitted if required. If "password" is present, Junos will attempt password authentication upon external AAA authentication failure. This feature is useful if the account of last resort is required while external AAA remains reachable but is misconfigured and prevents successful logon. If "password" is not present, Junos will not fail over to local authentication unless there is a loss of connectivity with the external AAA service (e.g., timeout). Verify the authentication order prefers external AAA (first in the order). user@host> show configuration system authentication-order authentication-order [ <external AAA> password ] --or-- authentication-order <external AAA>; Verify that direct root logon is disabled. user@host> show configuration system services ssh <<< missing root-login directive inherits the default 'deny' protocol-version v2; ...<snip>... --or-- root-login deny; ...<snip>... If one local account does not exist for use as the account of last resort, this is a finding.