The Juniper SRX Services Gateway must ensure access to start a UNIX-level shell is restricted to only the root account.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-223213 | JUSX-DM-000113 | SV-223213r1043177_rule | CCI-000382 | medium |
| Description | ||||
| Restricting the privilege to create a UNIX-level shell limits access to this powerful function. System administrators, regardless of their other permissions, will need to also know the root password for this access, thus limiting the possibility of malicious or accidental circumvention of security controls. | ||||
| STIG | Date | |||
| Juniper SRX Services Gateway NDM Security Technical Implementation Guide | 2024-12-20 | |||
Related Frameworks
3 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
CM-7
1.00
- DISA · V3R3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1711 mapping
3.4.6
1.00
- DISA · V3R3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000382
1.00
- DISA · V3R3 · disa_xccdf · related
Details
Check Text (C-223213r1043177_chk)
Verify each login class is configured to deny access to the UNIX shell.
[edit]
show system login
If each configured login class is not configured to deny access to the UNIX shell, this is a finding.
Fix Text (F-24874r513327_fix)
For each login class, add the following command to the stanza.
[edit]
set system login class <class name> deny-commands "(start shell)"