The Juniper SRX Services Gateway must limit the number of sessions per minute to an organization-defined number for SSH to protect remote access management from unauthorized access.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-223234	SRG-APP-000435-NDM-000315	JUSX-DM-000163	SV-223234r961620_rule	2024-12-20	3

Description
The rate-limit command limits the number of SSH session attempts allowed per minute which helps limit an attacker's ability to perform DoS attacks. The rate limit should be as restrictive as operationally practical. Juniper Networks recommends a best practice of 4 for the rate limit, however the limit should be as restrictive as operationally practical. User connections that exceed the rate-limit will be closed immediately after the connection is initiated. They will not be in a waiting state.

Description

The rate-limit command limits the number of SSH session attempts allowed per minute which helps limit an attacker's ability to perform DoS attacks. The rate limit should be as restrictive as operationally practical. Juniper Networks recommends a best practice of 4 for the rate limit, however the limit should be as restrictive as operationally practical. User connections that exceed the rate-limit will be closed immediately after the connection is initiated. They will not be in a waiting state.

ℹ️ Check
Verify the Juniper SRX sets a connection-limit for the SSH protocol. Show system services ssh If the SSH connection-limit is not set to 4 or an organization-defined value, this is a finding.

✔️ Fix
Configure the SSH protocol with a rate limit. [edit] set system services ssh rate-limit 4 Note: Juniper Networks recommends a best practice of 4 for the rate limit; however, the limit should be as restrictive as operationally practical.