The Juniper SRX Services Gateway must use SSHv2 with privacy options to protect the confidentiality of maintenance and diagnostic communications for nonlocal maintenance sessions using SSH.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-223227 | JUSX-DM-000150 | SV-223227r1056177_rule | CCI-003123 | high |
| Description | ||||
| To protect the confidentiality of nonlocal maintenance sessions when using SSH communications, SSHv2, AES ciphers, and key-exchange commands are configured. Nonlocal maintenance and diagnostic activities are activities conducted by individuals communicating through an external network (e.g., the internet) or internal network. The SSHv2 protocol suite includes Layer 7 protocols such as SCP and SFTP, which can be used for secure file transfers. The key-exchange commands limit the key exchanges to FIPS and DOD-approved methods. | ||||
| STIG | Date | |||
| Juniper SRX Services Gateway NDM Security Technical Implementation Guide | 2024-12-20 | |||
Details
Check Text (C-223227r1056177_chk)
Verify SSHv2, AES ciphers, and key-exchange commands are configured to protect confidentiality.
[edit]
show system services ssh
If SSHv2 is not configured to use AES ciphers and key-exchange commands, this is a finding.
Fix Text (F-24888r1056111_fix)
Configure SSH confidentiality options to comply with DOD requirements.
[edit]
set system services ssh protocol-version v2
set system services ssh ciphers aes256-ctr
set system services ssh ciphers aes192-ctr
set system services ssh ciphers aes128-ctr
set system services ssh macs hmac-sha2-512
set system services ssh macs hmac-sha2-256
set system services ssh key-exchange ecdh-sha2-nistp521
set system services ssh key-exchange ecdh-sha2-nistp384
set system services ssh key-exchange ecdh-sha2-nistp256