The Juniper SRX Services Gateway must generate log records containing the full-text recording of privileged commands.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-223197	JUSX-DM-000055	SV-223197r960909_rule		Low

Description
Reconstruction of harmful events or forensic analysis is not possible if log records do not contain enough information. Organizations consider limiting the additional audit information to only that information explicitly needed for specific audit requirements. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. While the Juniper SRX inherently has the capability to generate log records, by default only the high facility levels are captured and only to local files. Ensure at least one Syslog server and local files are configured to support requirements. However, the Syslog itself must also be configured to filter event records so it is not overwhelmed. A best practice when configuring the external Syslog server is to add similar log-prefixes to the log file names to help and researching of central Syslog server. Another best practice is to add a match condition to limit the recorded events to those containing the regular expression (REGEX).

Description

Reconstruction of harmful events or forensic analysis is not possible if log records do not contain enough information. Organizations consider limiting the additional audit information to only that information explicitly needed for specific audit requirements. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. While the Juniper SRX inherently has the capability to generate log records, by default only the high facility levels are captured and only to local files. Ensure at least one Syslog server and local files are configured to support requirements. However, the Syslog itself must also be configured to filter event records so it is not overwhelmed. A best practice when configuring the external Syslog server is to add similar log-prefixes to the log file names to help and researching of central Syslog server. Another best practice is to add a match condition to limit the recorded events to those containing the regular expression (REGEX).

STIG	Date
Juniper SRX SG NDM Security Technical Implementation Guide	2024-06-10

Details

Check Text ( C-24870r513281_chk )
Verify logging has been enabled and configured. [edit] show system syslog If at least one valid syslog host server and the syslog file names are not configured to capture "any" facility and "any" event, this is a finding.

Fix Text (F-24858r513282_fix)
The following commands configure syslog to record any use of any command, including privileged commands. Configure Syslog and local backup files to capture DoD-defined auditable events. [edit] set system syslog user * any emergency set system syslog host any any set system syslog host source-address set system syslog host log-prefix set system syslog file messages any info set system syslog file messages authorization none set system syslog file messages interactive-commands none set system syslog file messages daemon none set system syslog file User-Auth authorization any set system syslog file interactive-commands interactive-commands any set system syslog file processes daemon any set system syslog file account-actions change-log any any set file account-actions match “system login user” set system syslog console any any

Fix Text (F-24858r513282_fix)

The following commands configure syslog to record any use of any command, including privileged commands. Configure Syslog and local backup files to capture DoD-defined auditable events.

[edit]
set system syslog user * any emergency
set system syslog host any any
set system syslog host source-address
set system syslog host log-prefix
set system syslog file messages any info
set system syslog file messages authorization none
set system syslog file messages interactive-commands none
set system syslog file messages daemon none
set system syslog file User-Auth authorization any

set system syslog file interactive-commands interactive-commands any
set system syslog file processes daemon any
set system syslog file account-actions change-log any any
set file account-actions match “system login user”
set system syslog console any any