Skip to content

Commit 43fe4bd

Browse files
netpickermailsanjayhere
netpicker
and
mailsanjayhere
authored
Junos (#72)
* removing ruleset files * adding 3_interface rules and refs * Revert "adding 3_interface rules and refs" This reverts commit 6ec630d. * added 3_interfaces rules and refs again * added 4_protocols tests * restrctured 3_interfaces folder * added 6_services --------- Co-authored-by: mailsanjayhere <mailsanjayhere@gmail.com>
1 parent 76ce6c3 commit 43fe4bd

File tree

226 files changed

+3326
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

226 files changed

+3326
-0
lines changed

‎CIS/Junos/6_system/6_10_services/6_10_1_ssh/rule_6_10_1_10_ensure_only_suite_b_key_exchange_methods_are_set_for_ssh.py

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
from comfy.compliance import low
2+
3+
4+
@low(
5+
name='rule_6_10_1_10_ensure_only_suite_b_key_exchange_methods_are_set_for_ssh',
6+
platform=['juniper'],
7+
commands=dict(chk_cmd='')
8+
)
9+
def rule_6_10_1_10_ensure_only_suite_b_key_exchange_methods_are_set_for_ssh(commands, ref):
10+
assert '' in commands.chk_cmd, ref

‎CIS/Junos/6_system/6_10_services/6_10_1_ssh/rule_6_10_1_10_ensure_only_suite_b_key_exchange_methods_are_set_for_ssh.ref

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
.rule_6_10_1_10_ensure_only_suite_b_key_exchange_methods_are_set_for_ssh
2+
3+
Reference: Requirement 2.3 and 8.2.1
4+
Basics Guide, Juniper Networks
5+
(http://www.juniper.net/techpubs/en_US/junos9.5/information-products/topic-
6+
collections/swconfig-system-basics/ssh-services-configuring.html)
7+
tion-statement/system-edit-ssh-macs.html
8+
9+
Remediation: To remove a single non-Suite B Key Exchange method, issue the following command from
10+
the [edit system services ssh] hierarchy;
11+
[edit system services ssh]
12+
user@host# delete key-exchange <mac name>
13+
If multiple insecure Key Exchange methods were set, it will generally be easier to delete all
14+
the Key Exchange method restrictions with the following command:
15+
[edit system services ssh]
16+
user@host# delete key-exchange
17+
Once all insecure methods have been removed, add one or more stronger Key Exchange
18+
methods (in this example all Suite B methods available on most JUNOS devices are set in a
19+
single command)
20+
[edit system services ssh]
21+
user@host# set key-exchange [ ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-
22+
sha2-nistp512 ]
23+
NOTE - The ecdh-sha2-nistp512 Key Exchange method is not cited specifically in RFC6239,
24+
but is acceptable in addition/in place of the other NIST Elliptic Curve Diffie Hellman exchange
25+
methods for the purposes of this recommendation.
26+
27+
28+
29+
Finally, single Key Exchange methods or a smaller selection of these more secure methods
30+
may be selected on the user's discretion.
31+
[edit system services ssh]
32+
user@host# set key-exchange <method>
33+
34+
.

‎CIS/Junos/6_system/6_10_services/6_10_1_ssh/rule_6_10_1_11_ensure_strong_key_signing_algorithms_are_set_for_ssh.py

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
from comfy.compliance import medium
2+
3+
4+
@medium(
5+
name='rule_6_10_1_11_ensure_strong_key_signing_algorithms_are_set_for_ssh',
6+
platform=['juniper'],
7+
commands=dict(chk_cmd='')
8+
)
9+
def rule_6_10_1_11_ensure_strong_key_signing_algorithms_are_set_for_ssh(commands, ref):
10+
assert '' in commands.chk_cmd, ref

‎CIS/Junos/6_system/6_10_services/6_10_1_ssh/rule_6_10_1_11_ensure_strong_key_signing_algorithms_are_set_for_ssh.ref

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
.rule_6_10_1_11_ensure_strong_key_signing_algorithms_are_set_for_ssh
2+
3+
Reference: Requirement 2.3 and 8.2.1
4+
Basics Guide, Juniper Networks
5+
(http://www.juniper.net/techpubs/en_US/junos9.5/information-products/topic-
6+
collections/swconfig-system-basics/ssh-services-configuring.html)
7+
tion-statement/system-edit-ssh-host-key-algorithm.html
8+
9+
Remediation: To explicitly disable DSA signatures, type the following command at the [edit system
10+
services ssh] hierarchy:
11+
12+
13+
14+
[edit system services ssh]
15+
user@host#set hostkey-algorithm no-ssh-dss
16+
Enable one or more stronger ciphers using the following commands:
17+
[edit system services ssh]
18+
user@host#set hostkey-algorithm ssh-ecdsa
19+
user@host#set hostkey-algorithm ssh-ed25519
20+
user@host#set hostkey-algorithm ssh-rsa
21+
22+
.

‎CIS/Junos/6_system/6_10_services/6_10_1_ssh/rule_6_10_1_12_ensure_only_suite_b_based_key_signing_algorithms_are_set_for_ssh.py

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
from comfy.compliance import low
2+
3+
4+
@low(
5+
name='rule_6_10_1_12_ensure_only_suite_b_based_key_signing_algorithms_are_set_for_ssh',
6+
platform=['juniper'],
7+
commands=dict(chk_cmd='')
8+
)
9+
def rule_6_10_1_12_ensure_only_suite_b_based_key_signing_algorithms_are_set_for_ssh(commands, ref):
10+
assert '' in commands.chk_cmd, ref

‎CIS/Junos/6_system/6_10_services/6_10_1_ssh/rule_6_10_1_12_ensure_only_suite_b_based_key_signing_algorithms_are_set_for_ssh.ref

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
.rule_6_10_1_12_ensure_only_suite_b_based_key_signing_algorithms_are_set_for_ssh
2+
3+
Reference: Requirement 2.3 and 8.2.1
4+
Basics Guide, Juniper Networks
5+
6+
7+
8+
(http://www.juniper.net/techpubs/en_US/junos9.5/information-products/topic-
9+
collections/swconfig-system-basics/ssh-services-configuring.html)
10+
tion-statement/system-edit-ssh-host-key-algorithm.html
11+
12+
Remediation: To explicitly disable DSA, RSA and ED25519 signatures, type the following commands at
13+
the [edit system services ssh] hierarchy:
14+
[edit system services ssh]
15+
user@host#set hostkey-algorithm no-ssh-dss
16+
user@host#set hostkey-algorithm no-ssh-rsa
17+
user@host#set hostkey-algorithm no-ssh-ed25519
18+
Enable ECDSA for SSH Public Keys using the following commands:
19+
[edit system services ssh]
20+
user@host#set hostkey-algorithm ssh-ecdsa
21+
22+
.

‎CIS/Junos/6_system/6_10_services/6_10_1_ssh/rule_6_10_1_13_ensure_ssh_key_authentication_is_disabled.py

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
from comfy.compliance import low
2+
3+
4+
@low(
5+
name='rule_6_10_1_13_ensure_ssh_key_authentication_is_disabled',
6+
platform=['juniper'],
7+
commands=dict(chk_cmd='')
8+
)
9+
def rule_6_10_1_13_ensure_ssh_key_authentication_is_disabled(commands, ref):
10+
assert '' in commands.chk_cmd, ref

‎CIS/Junos/6_system/6_10_services/6_10_1_ssh/rule_6_10_1_13_ensure_ssh_key_authentication_is_disabled.ref

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
.rule_6_10_1_13_ensure_ssh_key_authentication_is_disabled
2+
3+
Reference: tion-statement/no-public-keys-edit-system-services.html
4+
5+
Remediation: To disable the use of SSH Key based Authentication, issue the following command from the
6+
[edit system service ssh] hierarchy:
7+
[edit system services ssh]
8+
user@host# set no-public-keys
9+
10+
.

‎CIS/Junos/6_system/6_10_services/6_10_1_ssh/rule_6_10_1_1_ensure_ssh_service_is_configured_if_remote_cli_is_required.py

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
from comfy.compliance import medium
2+
3+
4+
@medium(
5+
name='rule_6_10_1_1_ensure_ssh_service_is_configured_if_remote_cli_is_required',
6+
platform=['juniper'],
7+
commands=dict(chk_cmd='')
8+
)
9+
def rule_6_10_1_1_ensure_ssh_service_is_configured_if_remote_cli_is_required(commands, ref):
10+
assert '' in commands.chk_cmd, ref

‎CIS/Junos/6_system/6_10_services/6_10_1_ssh/rule_6_10_1_1_ensure_ssh_service_is_configured_if_remote_cli_is_required.ref

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
.rule_6_10_1_1_ensure_ssh_service_is_configured_if_remote_cli_is_required
2+
3+
Reference: Requirement 2.3 and 8.2.1
4+
Basics Guide, Juniper Networks
5+
(http://www.juniper.net/techpubs/en_US/junos9.5/information-products/topic-
6+
collections/swconfig-system-basics/ssh-services-configuring.html)
7+
tion-statement/ssh-edit-system.html
8+
9+
Remediation: To enable SSH access issue the following command from the [edit system] hierarchy:
10+
[edit system]
11+
user@host#set services ssh
12+
13+
14+
15+
Where SSH is used, all other Recommendations in this section should be considered.
16+
If SSH is currently configured but is not required it should be disabled using the following
17+
command from the [edit system] hierarchy:
18+
[edit system]
19+
user@host#delete services ssh
20+
21+
.

‎CIS/Junos/6_system/6_10_services/6_10_1_ssh/rule_6_10_1_2_ensure_ssh_is_restricted_to_version_2.py

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
from comfy.compliance import medium
2+
3+
4+
@medium(
5+
name='rule_6_10_1_2_ensure_ssh_is_restricted_to_version_2',
6+
platform=['juniper'],
7+
commands=dict(chk_cmd='')
8+
)
9+
def rule_6_10_1_2_ensure_ssh_is_restricted_to_version_2(commands, ref):
10+
assert '' in commands.chk_cmd, ref

‎CIS/Junos/6_system/6_10_services/6_10_1_ssh/rule_6_10_1_2_ensure_ssh_is_restricted_to_version_2.ref

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
.rule_6_10_1_2_ensure_ssh_is_restricted_to_version_2
2+
3+
Reference: Agency (NSA)
4+
Basics Guide, Juniper Networks
5+
(http://www.juniper.net/techpubs/en_US/junos9.5/information-products/topic-
6+
collections/swconfig-system-basics/ssh-services-configuring.html)
7+
8+
Remediation: To restrict SSH to Version 2 only, issue the following command from the [edit system
9+
service ssh] hierarchy:
10+
[edit system services ssh]
11+
user@host#set protocol-version v2
12+
13+
.

‎CIS/Junos/6_system/6_10_services/6_10_1_ssh/rule_6_10_1_3_ensure_ssh_connection_limit_is_set.py

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
from comfy.compliance import medium
2+
3+
4+
@medium(
5+
name='rule_6_10_1_3_ensure_ssh_connection_limit_is_set',
6+
platform=['juniper'],
7+
commands=dict(chk_cmd='')
8+
)
9+
def rule_6_10_1_3_ensure_ssh_connection_limit_is_set(commands, ref):
10+
assert '' in commands.chk_cmd, ref

‎CIS/Junos/6_system/6_10_services/6_10_1_ssh/rule_6_10_1_3_ensure_ssh_connection_limit_is_set.ref

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
.rule_6_10_1_3_ensure_ssh_connection_limit_is_set
2+
3+
Reference: Agency (NSA)
4+
Basics Guide, Juniper Networks
5+
(http://www.juniper.net/techpubs/en_US/junos9.5/information-products/topic-
6+
collections/swconfig-system-basics/ssh-services-configuring.html)
7+
8+
Remediation: To restrict concurrent SSH connections, issue the following command from the [edit
9+
system services ssh] hierarchy:
10+
[edit system services ssh]
11+
user@host#set connection-limit <limit>
12+
NOTE - On some platforms the maximum configuration connection limit may be significantly
13+
lower than 10, for example, on an SRX110 the connection limit can be set to a value between 1
14+
and 3.
15+
16+
17+
18+
19+
.

‎CIS/Junos/6_system/6_10_services/6_10_1_ssh/rule_6_10_1_4_ensure_ssh_rate_limit_is_configured.py

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
from comfy.compliance import medium
2+
3+
4+
@medium(
5+
name='rule_6_10_1_4_ensure_ssh_rate_limit_is_configured',
6+
platform=['juniper'],
7+
commands=dict(chk_cmd='')
8+
)
9+
def rule_6_10_1_4_ensure_ssh_rate_limit_is_configured(commands, ref):
10+
assert '' in commands.chk_cmd, ref

‎CIS/Junos/6_system/6_10_services/6_10_1_ssh/rule_6_10_1_4_ensure_ssh_rate_limit_is_configured.ref

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
.rule_6_10_1_4_ensure_ssh_rate_limit_is_configured
2+
3+
Reference: Agency (NSA)
4+
Basics Guide, Juniper Networks
5+
(http://www.juniper.net/techpubs/en_US/junos9.5/information-products/topic-
6+
collections/swconfig-system-basics/ssh-services-configuring.html)
7+
8+
Remediation: To restrict concurrent SSH connections, issue the following command from the [edit
9+
system] hierarchy;
10+
[edit system]
11+
user@host#set services ssh rate-limit <limit>
12+
13+
14+
15+
16+
17+
.

‎CIS/Junos/6_system/6_10_services/6_10_1_ssh/rule_6_10_1_5_ensure_remote_root_login_is_denied_via_ssh.py

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
from comfy.compliance import medium
2+
3+
4+
@medium(
5+
name='rule_6_10_1_5_ensure_remote_root_login_is_denied_via_ssh',
6+
platform=['juniper'],
7+
commands=dict(chk_cmd='')
8+
)
9+
def rule_6_10_1_5_ensure_remote_root_login_is_denied_via_ssh(commands, ref):
10+
assert '' in commands.chk_cmd, ref

‎CIS/Junos/6_system/6_10_services/6_10_1_ssh/rule_6_10_1_5_ensure_remote_root_login_is_denied_via_ssh.ref

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
.rule_6_10_1_5_ensure_remote_root_login_is_denied_via_ssh
2+
3+
Reference: Networks (http://www.juniper.net/techpubs/software/junos/junos92/swconfig-
4+
system-basics/configuringthe-root-login.html)
5+
6+
Remediation: To disable remote access to the Root account issue the following command from the [edit
7+
system services ssh] hierarchy:
8+
[edit system services ssh]
9+
user@host#set root-login deny
10+
11+
.

‎CIS/Junos/6_system/6_10_services/6_10_1_ssh/rule_6_10_1_6_ensure_strong_ciphers_are_set_for_ssh.py

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
from comfy.compliance import medium
2+
3+
4+
@medium(
5+
name='rule_6_10_1_6_ensure_strong_ciphers_are_set_for_ssh',
6+
platform=['juniper'],
7+
commands=dict(chk_cmd='')
8+
)
9+
def rule_6_10_1_6_ensure_strong_ciphers_are_set_for_ssh(commands, ref):
10+
assert '' in commands.chk_cmd, ref

‎CIS/Junos/6_system/6_10_services/6_10_1_ssh/rule_6_10_1_6_ensure_strong_ciphers_are_set_for_ssh.ref

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
.rule_6_10_1_6_ensure_strong_ciphers_are_set_for_ssh
2+
3+
Reference: Requirement 2.3 and 8.2.1
4+
Basics Guide, Juniper Networks
5+
(http://www.juniper.net/techpubs/en_US/junos9.5/information-products/topic-
6+
collections/swconfig-system-basics/ssh-services-configuring.html)
7+
8+
9+
10+
tion-statement/system-edit-ssh-ciphers.html
11+
12+
Remediation: To remove a single insecure cipher, issue the following command from the [edit system
13+
services ssh] hierarchy;
14+
[edit system services ssh]
15+
user@host#delete ciphers <cipher suite name>
16+
If multiple insecure Ciphers were set, it will generally be easier to delete all the Cipher
17+
restrictions with the following command:
18+
[edit system services ssh]
19+
user@host#delete ciphers
20+
Once all insecure Ciphers have been removed, add one or more stronger Ciphers (in this
21+
example all stronger Ciphers available on most JUNOS devices are set in a single command)
22+
[edit system services ssh]
23+
user@host#set ciphers [ 3des-cbc aes128-cbc aes128-ctr aes128-gcm@openssh.com
24+
aes192-cbc aes192-ctr aes256-cbc aes256-ctr aes256-gcm@openssh.com ]
25+
Note - note all of the Ciphers in the example above are supported on all JUNOS devices.
26+
In many cases the GCM mode AES ciphers may be unavailable, a shorter list of Ciphers may
27+
be set with the following command for these systems:
28+
[edit system services ssh]
29+
user@host#set ciphers [ 3des-cbc aes128-cbc aes128-ctr aes192-cbc aes192-ctr
30+
aes256-cbc aes256-ctr ]
31+
Finally, single Ciphers or a smaller selection of these more secure Ciphers may be selected
32+
on the user's discretion.
33+
[edit system services ssh]
34+
user@host#set ciphers <cipher suite name>
35+
36+
.

‎CIS/Junos/6_system/6_10_services/6_10_1_ssh/rule_6_10_1_7_ensure_only_suite_b_ciphers_are_set_for_ssh.py

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
from comfy.compliance import low
2+
3+
4+
@low(
5+
name='rule_6_10_1_7_ensure_only_suite_b_ciphers_are_set_for_ssh',
6+
platform=['juniper'],
7+
commands=dict(chk_cmd='')
8+
)
9+
def rule_6_10_1_7_ensure_only_suite_b_ciphers_are_set_for_ssh(commands, ref):
10+
assert '' in commands.chk_cmd, ref

‎CIS/Junos/6_system/6_10_services/6_10_1_ssh/rule_6_10_1_7_ensure_only_suite_b_ciphers_are_set_for_ssh.ref

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
.rule_6_10_1_7_ensure_only_suite_b_ciphers_are_set_for_ssh
2+
3+
Reference: Requirement 2.3 and 8.2.1
4+
Basics Guide, Juniper Networks
5+
(http://www.juniper.net/techpubs/en_US/junos9.5/information-products/topic-
6+
collections/swconfig-system-basics/ssh-services-configuring.html)
7+
tion-statement/system-edit-ssh-ciphers.html
8+
9+
Remediation: To remove a single insecure cipher, issue the following command from the [edit system
10+
services ssh] hierarchy;
11+
[edit system services ssh]
12+
user@host#delete ciphers <cipher suite name>
13+
If multiple insecure Ciphers were set, it will generally be easier to delete all the Cipher
14+
restrictions with the following command:
15+
[edit system services ssh]
16+
user@host#delete ciphers
17+
Once all insecure Ciphers have been removed, add one or more of the AES-GCM ciphers.
18+
[edit system services ssh]
19+
user@host#set ciphers [ aes128-gcm@openssh.com aes256-gcm@openssh.com ]
20+
21+
.

‎CIS/Junos/6_system/6_10_services/6_10_1_ssh/rule_6_10_1_8_ensure_strong_macs_are_set_for_ssh.py

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
from comfy.compliance import medium
2+
3+
4+
@medium(
5+
name='rule_6_10_1_8_ensure_strong_macs_are_set_for_ssh',
6+
platform=['juniper'],
7+
commands=dict(chk_cmd='')
8+
)
9+
def rule_6_10_1_8_ensure_strong_macs_are_set_for_ssh(commands, ref):
10+
assert '' in commands.chk_cmd, ref

0 commit comments

Comments
 (0)