- play_arrow Overview
- play_arrow Configuring Roles and Authentication Methods
- Understanding Roles and Services for Junos OS in Common Criteria and FIPS Mode
- Understanding Password Specifications and Guidelines for Junos OS in FIPS Mode
- Downloading Software Packages from Juniper Networks
- Installing Software on Network Services Platform with a Single Routing Engine
- Understanding Zeroization to Clear System Data for FIPS Mode
- Zeroizing the System
- Establishing Root Password Access
- Enabling FIPS Mode
- play_arrow Configuring Administrative Credentials and Privileges
- play_arrow Configuring the Remote Syslog Server
- play_arrow Configuring Audit Log Options
- play_arrow Configuring Event Logging
- play_arrow Configuring VPNs
- play_arrow Configuring Security Flow Policies
- play_arrow Configuring Traffic Filtering Rules
- Overview
- Understanding Protocol Support
- Configuring Traffic Filter Rules
- Configuring Default Deny-All and Reject Rules
- Logging the Dropped Packets Using Default Deny-all Option
- Configuring Mandatory Reject Rules for Invalid Fragments and Fragmented IP Packets
- Configuring Default Reject Rules for Source Address Spoofing
- Configuring Default Reject Rules with IP Options
- Configuring Default Reject Rules
- play_arrow Configuring Network Attacks
- Configuring IP Teardrop Attack Screen
- Configuring TCP Land Attack Screen
- Configuring ICMP Fragment Screen
- Configuring Ping-Of-Death Attack Screen
- Configuring tcp-no-flag Attack Screen
- Configuring TCP SYN-FIN Attack Screen
- Configuring TCP fin-no-ack Attack Screen
- Configuring UDP Bomb Attack Screen
- Configuring UDP CHARGEN DoS Attack Screen
- Configuring TCP SYN and RST Attack Screen
- Configuring ICMP Flood Attack Screen
- Configuring TCP SYN Flood Attack Screen
- Configuring TCP Port Scan Attack Screen
- Configuring UDP Port Scan Attack Screen
- Configuring IP Sweep Attack Screen
- play_arrow Configuring the IDP Extended Package
- play_arrow Performing Self-Tests on a Device
- play_arrow Configuration Statements
- fips (FIPS)
- level (FIPS)
- checksum-validate
- code
- data-length
- destination-option
- extension-header
- header-type
- home-address
- identification
- icmpv6 (Security IDP Custom Attack)
- ihl (Security IDP Custom Attack)
- option-type
- reserved (Security IDP Custom Attack)
- routing-header
- sequence-number (Security IDP ICMPv6 Headers)
- type (Security IDP ICMPv6 Headers)
- play_arrow Operational Commands
Limiting the Number of User Login Attempts for SSH Sessions
An administrator may login to a device through SSH. Administrator credentials are stored locally on the device. If the remote administrator presents a valid username and password, access to the Target of Evaluation (TOE) is granted. If the credentials are invalid, the TOE allows the authentication to be retried after an interval that starts after 1 second and increases exponentially. If the number of authentication attempts exceed the configured maximum, no authentication attempts are accepted for a configured time interval. When the interval expires, authentication attempts are again accepted.
You configure the amount of time the device gets locked after
failed attempts. The amount of time in minutes before the user can
attempt to log in to the device after being locked out due to the
number of failed login attempts specified in the tries-before-disconnect statement. When a user fails to correctly login after the number
of allowed attempts specified by the tries-before-disconnect statement, the user must wait the configured amount of minutes before
attempting to log in to the device again. The lockout-period must be greater than zero. The range at which you can configure
the lockout-period is one through 43,200 minutes.
[edit system login] user@host# set retry-options lockout-period <number>
You can configure the device to limit the number of attempts to enter a password while logging through SSH. Using the following command, the connection.
[edit system login] user@host# set retry-options tries-before-disconnect <number>
Here, tries-before-disconnect is the number of times
a user can attempt to enter a password when logging in. The connection
closes if a user fails to log in after the number specified. The range
is from 2 through 10, and the default value is 3.
You can also configure a delay, in seconds, before a user can try to enter a password after a failed attempt.
[edit system login] user@host# set retry-options backoff-threshold <number>
Here, backoff-threshold is the threshold for the
number of failed login attempts before the user experiences a delay
in being able to enter a password again. The range is from 1 through
3, and the default value is 2 seconds.
In addition, the device can be configured to specify the threshold for the number of failed attempts before the user experiences a delay in entering the password again.
[edit system login] user@host# set retry-options backoff-factor <number>
Here, backoff-factor is the length of time, in seconds,
before a user can attempt to log in after a failed attempt. The delay
increases by the value specified for each subsequent attempt after
the threshold. The range is from 5 through 10, and the default value
is 5 seconds.
You can control user access through SSH. By configuring ssh root-login deny , you can ensure the root account remains
active and continues to have local administrative privileges to the
TOE even if other remote users are logged off.
[edit system] user@host# set services ssh root-login deny
The SSH2 protocol provides secure terminal sessions utilizing the secure encryption. The SSH2 protocol enforces running the key-exchange phase and changing the encryption and integrity keys for the session. Key exchange is done periodically, after specified seconds or after specified bytes of data have passed over the connection. You can configure thresholds for SSH rekeying, FCS_SSHS_EXT.1.8 and FCS_SSHC_EXT.1.8. The TSF ensures that within the SSH connections the same session keys are used for a threshold of no longer than one hour, and no more than one gigabyte of the transmitted data. When either of the thresholds are reached, a rekey must be performed.
[edit system] user@host# set services ssh rekey time-limit number
Time limit before renegotiating session keys is 1 through 1440 minutes.
[edit system] user@host# set services ssh rekey data-limit number
Data limit before renegotiating session keys is 51200 through 4294967295 byte.
