Juniper Junos stock definitions

Stock definitions for Juniper Junos, from the juniper/ folder. They check the configuration in set format, as returned by show configuration | display set, with one set command per line. They do not match brace (hierarchical) format from show configuration. This page documents release v1.2.0. See importing a stock template to load one into rConfig.

Caution

These rules are synthetic tested: their expected results are recorded only against synthetic display set samples, built from rConfig Pro’s Junos demo generator and Junos command syntax. They have not yet been checked against output from a real Junos device. Run them against one of your own devices and review the results before you rely on them.

Hardening definitions

Junos management access

junos-management-access.policy · 5 rules · minimum rConfig 8.3.0 · Synthetic tested

SSH enabled without protocol version 1, SSH cipher and MAC lists with no weak algorithms, no Telnet, a login banner, and a login class idle-timeout of 10 minutes or less.

Rule	Method	What it checks
SSH is enabled and SSH protocol version 1 is not (set system services ssh, no protocol-version v1)	evaluate_block	A set system services ssh line is present, and no protocol-version line includes v1. A config with no protocol-version line passes, because version 2 is the default and Junos does not print it.
SSH ciphers and MACs are set, and none is CBC, 3DES, arcfour, blowfish, MD5, SHA-1 or RIPEMD-160 based	evaluate_block	Both set system services ssh ciphers and set system services ssh macs lines are present, no cipher is CBC, 3DES, arcfour or blowfish, and no MAC is hmac-md5, hmac-sha1 or hmac-ripemd160 based.
Telnet is not enabled (fails on set system services telnet)	must_not_match_regex	No line reads set system services telnet, with or without options.
A login banner is configured (set system login message)	must_match_regex	A set system login message line with text is present.
A login class sets an idle-timeout of 1 to 10 minutes, and no class sets 0 or more than 10	evaluate_block	At least one set system login class ... idle-timeout line has a value from 1 to 10, and no class has 0 or a value above 10.

References

Published references recorded in the sidecar. A rule provides evidence towards a control; it does not make a device compliant with it.

Rule	NIST SP 800-53	HIPAA (45 CFR)
SSH is enabled and SSH protocol version 1 is not (set system services ssh, no protocol-version v1)	AC-17	164.312(a)(1)
Telnet is not enabled (fails on set system services telnet)	AC-17	164.312(a)(1)

Known limitations

• The idle-timeout rule needs at least one login class with an idle-timeout. Built-in classes such as super-user cannot carry one, so users in those classes are not covered.
• The cipher and MAC rule accepts the bracket form (ciphers [ aes256-ctr aes128-ctr ]) or one value per line.

Junos AAA and local credentials

junos-aaa.policy · 2 rules · minimum rConfig 8.0.2 · Synthetic tested

An authentication order that starts with RADIUS or TACACS+ and falls back to local passwords, and no MD5 password hashes.

Rule	Method	What it checks
The authentication order starts with RADIUS or TACACS+ and ends with local password fallback (set system authentication-order)	must_match_regex	The set system authentication-order line, in bracket form, starts with radius or tacplus and ends with password, for example [ tacplus password ].
No root or local user password uses an MD5 hash (fails on encrypted-password “$1$…”)	must_not_match_regex	No root-authentication or login user ... authentication line has an encrypted-password that starts with $1$, the MD5 hash format.

References

Published references recorded in the sidecar. A rule provides evidence towards a control; it does not make a device compliant with it.

Rule	NIST SP 800-53	HIPAA (45 CFR)	NIST CSF 1.1
The authentication order starts with RADIUS or TACACS+ and ends with local password fallback (set system authentication-order)	AC-2	164.312(a)(1)	PR.AC-1
No root or local user password uses an MD5 hash (fails on encrypted-password “$1$…”)	IA-5	None	None

Known limitations

• The authentication order rule expects the bracket form that display set uses for a list, for example set system authentication-order [ tacplus password ].
• Junos never stores plain-text-password: it keeps only the encrypted-password hash. The rule therefore checks the hash type rather than looking for plaintext.

Junos SNMP

junos-snmp.policy · 2 rules · minimum rConfig 8.3.0 · Synthetic tested

No SNMPv1 or SNMPv2c communities, and SNMPv3 users with SHA authentication and AES-128 privacy.

Rule	Method	What it checks
No SNMPv1 or SNMPv2c community is configured (fails on set snmp community)	must_not_match_regex	No line starts with set snmp community.
SNMPv3 USM users use SHA authentication and AES-128 privacy, and none uses MD5, DES, 3DES or none	evaluate_block	A local-engine USM user has an authentication-sha line (including SHA-2 variants such as authentication-sha256) and a privacy-aes128 line, and no USM user uses authentication-md5, authentication-none, privacy-des, privacy-3des or privacy-none.

References

Published references recorded in the sidecar. A rule provides evidence towards a control; it does not make a device compliant with it.

Rule	NIST SP 800-53	HIPAA (45 CFR)
No SNMPv1 or SNMPv2c community is configured (fails on set snmp community)	SC-12	164.312(e)(1)
SNMPv3 USM users use SHA authentication and AES-128 privacy, and none uses MD5, DES, 3DES or none	SC-12	164.312(e)(1)

Junos logging

junos-logging.policy · 5 rules · minimum rConfig 8.0.2 · Synthetic tested

A remote syslog host for any facility at info or notice and for authorization messages, millisecond timestamps, no console logging, and the UTC time zone.

Rule	Method	What it checks
A remote syslog host receives any facility at info or notice (set system syslog host … any info or any notice)	must_match_regex	A set system syslog host line ends with any info or any notice. A syslog file line does not count.
A remote syslog host receives authorization messages at info or any (set system syslog host … authorization info)	must_match_regex	A set system syslog host line ends with authorization info or authorization any.
Syslog timestamps include milliseconds (set system syslog time-format millisecond)	must_match_regex	A line reads set system syslog time-format millisecond or set system syslog time-format year millisecond.
Console logging is off (fails on set system syslog console)	must_not_match_regex	No line starts with set system syslog console.
The system time zone is UTC (fails on a set system time-zone line other than UTC, the default)	must_not_match_regex	No set system time-zone line sets a zone other than UTC. A config with no time-zone line passes, because UTC is the default and Junos does not print it.

References

Published references recorded in the sidecar. A rule provides evidence towards a control; it does not make a device compliant with it.

Rule	NIST SP 800-53	HIPAA (45 CFR)	NIST CSF 1.1
A remote syslog host receives any facility at info or notice (set system syslog host … any info or any notice)	AU-2, AU-12	164.312(b)	DE.CM-1
A remote syslog host receives authorization messages at info or any (set system syslog host … authorization info)	AU-2, AU-12	164.312(b)	None
Syslog timestamps include milliseconds (set system syslog time-format millisecond)	AU-2, AU-12	164.312(b)	None
Console logging is off (fails on set system syslog console)	None	164.312(b)	None

Junos services

junos-services.policy · 2 rules · minimum rConfig 8.0.2 · Synthetic tested

No finger, FTP, rlogin, rsh or rexec service, and ICMP redirects disabled.

Rule	Method	What it checks
No legacy service is enabled (fails on set system services finger, ftp, rlogin, rsh or rexec)	must_not_match_regex	No set system services line enables finger, ftp, rlogin, rsh or rexec.
ICMP redirects are disabled (set system no-redirects)	must_match_single_string	A line reads exactly set system no-redirects. Junos sends redirects by default, so the line must be present.

References

Published references recorded in the sidecar. A rule provides evidence towards a control; it does not make a device compliant with it.

Rule	NIST SP 800-53	HIPAA (45 CFR)
No legacy service is enabled (fails on set system services finger, ftp, rlogin, rsh or rexec)	CM-7	164.312(c)(1)

Junos interfaces

junos-interfaces.policy · 1 rule · minimum rConfig 8.0.2 · Synthetic tested

Every interface is disabled or has a description.

Rule	Method	What it checks
Every interface is disabled or has a description (set interfaces <name> disable or set interfaces <name> description)	must_not_match_regex	Each interface’s run of set interfaces <name> ... lines must include set interfaces <name> disable or set interfaces <name> description. An interface with neither, which is likely unused, fails.

Known limitations

• The rule expects each interface’s set interfaces lines to be next to each other, as display set prints them.
• A description on a unit (set interfaces irb unit 99 description ...) does not count; set it on the interface. interface-range entries are not checked.

Notes for all Juniper files

• Junos does not print a setting that is at its default. SSH protocol version 2 and the UTC time zone are defaults, so those rules fail only when a different value is set. ICMP redirects are sent by default, so set system no-redirects must be present.
• A deactivated statement still appears in display set output as a set line, followed by a deactivate line, and the rules treat it as configured.
• Regex rules use the /.../m form, so ^ and $ match at each line of the config.