For local accounts using password authentication (i.e., the root account and the account of last resort) the Juniper SRX Services Gateway must use the SHA1 or later protocol for password authentication.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-66527	JUSX-DM-000136	SV-81017r1_rule		Medium

Description
Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. The password format command is an optional command that specifies the hash algorithm used for authenticating passwords. The options are MD5, SHA1, or DES. SHA1 is recommended because it is a FIPS-approved algorithm and provides stronger security.

Description

Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. The password format command is an optional command that specifies the hash algorithm used for authenticating passwords. The options are MD5, SHA1, or DES. SHA1 is recommended because it is a FIPS-approved algorithm and provides stronger security.

STIG	Date
Juniper SRX SG NDM Security Technical Implementation Guide	2019-06-28

Details

Check Text ( C-67173r1_chk )
Verify the default local password enforces this requirement by entering the following in configuration mode. [edit] show system login password If the password format is not set to SHA-1, this is a finding.

Fix Text (F-72603r1_fix)
Enter the configuration mode on the Juniper SRX, set the password option for the local user account of last resort using the following command. [edit] set system login password format sha1