OpenControls Logo

STIG Viewer

STIGViewer Support

The Juniper SRX Services Gateway must use SSHv2 with privacy options to protect the confidentiality of maintenance and diagnostic communications for nonlocal maintenance sessions using SSH.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-223227JUSX-DM-000150SV-223227r1056177_ruleCCI-003123high
Description
To protect the confidentiality of nonlocal maintenance sessions when using SSH communications, SSHv2, AES ciphers, and key-exchange commands are configured. Nonlocal maintenance and diagnostic activities are activities conducted by individuals communicating through an external network (e.g., the internet) or internal network. The SSHv2 protocol suite includes Layer 7 protocols such as SCP and SFTP, which can be used for secure file transfers. The key-exchange commands limit the key exchanges to FIPS and DOD-approved methods.
STIGDate
Juniper SRX Services Gateway NDM Security Technical Implementation Guide2024-12-20

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MNT-05.3Remote Maintenance Cryptographic Protection
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (26) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-2(4)Automated Audit Actions
1.00
AC-4Information Flow Enforcement
1.00
AC-6(9)Log Use of Privileged Functions
1.00
AU-12Audit Record Generation
1.00
AU-3Content of Audit Records
1.00
AU-9(3)Cryptographic Protection
1.00
CM-5(1)Automated Access Enforcement and Audit Records
1.00
CM-6Configuration Settings
1.00

+16 more (top 10 by confidence shown)

CCI1 mapping
CCI-003123
1.00

Details

Check Text (C-223227r1056177_chk)

Verify SSHv2, AES ciphers, and key-exchange commands are configured to protect confidentiality. [edit] show system services ssh If SSHv2 is not configured to use AES ciphers and key-exchange commands, this is a finding.

Fix Text (F-24888r1056111_fix)

Configure SSH confidentiality options to comply with DOD requirements. [edit] set system services ssh protocol-version v2 set system services ssh ciphers aes256-ctr set system services ssh ciphers aes192-ctr set system services ssh ciphers aes128-ctr set system services ssh macs hmac-sha2-512 set system services ssh macs hmac-sha2-256 set system services ssh key-exchange ecdh-sha2-nistp521 set system services ssh key-exchange ecdh-sha2-nistp384 set system services ssh key-exchange ecdh-sha2-nistp256