The Juniper EX switch must be configured to automatically audit account creation.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-253879	JUEX-NM-000020	SV-253879r843670_rule		Medium

Description
Upon gaining access to a network device, an attacker will often first attempt to create a persistent method of reestablishing access. One way to accomplish this is to create a new account. Notification of account creation helps to mitigate this risk. Auditing account creation provides the necessary reconciliation that account management procedures are being followed. Without this audit trail, personnel without the proper authorization may gain access to critical network nodes.

Description

Upon gaining access to a network device, an attacker will often first attempt to create a persistent method of reestablishing access. One way to accomplish this is to create a new account. Notification of account creation helps to mitigate this risk. Auditing account creation provides the necessary reconciliation that account management procedures are being followed. Without this audit trail, personnel without the proper authorization may gain access to critical network nodes.

STIG	Date
Juniper EX Series Switches Network Device Management Security Technical Implementation Guide	2022-08-31

Details

Check Text ( C-57331r843668_chk )
Review the network device configuration to determine if it automatically audits account creation or is configured to use an authentication server that would perform this function. Verify the system logs the facility "any", or minimally "change-log" and "interactive-commands", and the logging level is appropriate. Generally, the "all" (debug) logging level should be avoided because the number of logged messages is significant. [edit system syslog] host { any info; } file { change-log info; interactive-commands info; } Note: If minimally logging only configuration changes, there will be other files receiving the events from the other logging facilities (e.g., "authorizations" or "firewall"). Syslog outputs in standard format unless the "structured-data" directive is configured. Verify the "structured-data" command for all files and external syslog servers requiring that format. For example: [edit system syslog] host { change-log info; interactive-commands info; structured-data; } file { any info; structured-data; } If account creation is not automatically audited, this is a finding.

Check Text ( C-57331r843668_chk )

Review the network device configuration to determine if it automatically audits account creation or is configured to use an authentication server that would perform this function.

Verify the system logs the facility "any", or minimally "change-log" and "interactive-commands", and the logging level is appropriate. Generally, the "all" (debug) logging level should be avoided because the number of logged messages is significant.

[edit system syslog]
host {
any info;
}
file {
change-log info;
interactive-commands info;
}
Note: If minimally logging only configuration changes, there will be other files receiving the events from the other logging facilities (e.g., "authorizations" or "firewall").

Syslog outputs in standard format unless the "structured-data" directive is configured. Verify the "structured-data" command for all files and external syslog servers requiring that format. For example:

[edit system syslog]
host {
change-log info;
interactive-commands info;
structured-data;
}
file {
any info;
structured-data;
}

If account creation is not automatically audited, this is a finding.

Fix Text (F-57282r843669_fix)
Configure the network device or its associated authentication server to automatically audit the creation of accounts. set system syslog host change-log info set system syslog host interactive-commands info -or- set system syslog host any info set system syslog file change-log info set system syslog file interactive-commands info -or- set system syslog file any info