The Juniper SRX Services Gateway must securely configure SSHv2 FIPS 140-2/140-3 validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of maintenance and diagnostic communications for nonlocal maintenance sessions.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
high	V-223225	SRG-APP-000411-NDM-000330	JUSX-DM-000147	SV-223225r1056185_rule	2024-12-20	3

Description
To protect the integrity of nonlocal maintenance sessions, SSHv2 with HMAC algorithms for integrity checking must be configured. Nonlocal maintenance and diagnostic activities are activities conducted by individuals communicating through an external network (e.g., the internet) or internal network. The SSHv2 protocol suite includes Layer 7 protocols such as SCP and SFTP, which can be used for secure file transfers.

Description

To protect the integrity of nonlocal maintenance sessions, SSHv2 with HMAC algorithms for integrity checking must be configured. Nonlocal maintenance and diagnostic activities are activities conducted by individuals communicating through an external network (e.g., the internet) or internal network. The SSHv2 protocol suite includes Layer 7 protocols such as SCP and SFTP, which can be used for secure file transfers.

ℹ️ Check
Verify SSHv2 and HMAC algorithms for integrity checking. [edit] show system services ssh If SSHv2 and integrity options are not configured in compliance with DOD requirements for nonlocal maintenance session, this is a finding.

✔️ Fix
Configure SSH integrity options. [edit] set system services ssh protocol-version v2 set system services ssh macs hmac-sha2-512 set system services ssh macs hmac-sha2-256