Configuring a Network Device collaborative Protection Profile for an Authorized Administrator

date_range 10-Jun-22

arrow_backward

arrow_forward

An account for root is always present in a configuration and is not intended for use in normal operation. In the evaluated configuration, the root account is restricted to the initial installation and configuration of the evaluated device.

An NDcPP Version 2.2e authorized administrator must have all permissions, including the ability to change the device configuration.

To configure an authorized administrator:

Create a login class named security-admin with all permissions.
```
[edit]
root@host# set system login class security-admin permissions all
```
Configure the hashing algorithm used for password storage as sha512.
```
[edit]
root@host# set system login password format sha512
```
Commit the changes.
```
[edit]
root@host# commit
```

Define your NDcPPv2.2e user authorized administrator.

content_copy zoom_out_map
[edit]
root@host# set system login user NDcPPv2.2e-user full-name Common-Criteria-NDcPPv2.2e-Authorized-Administrator class security-admin authentication encrypted-password <password>

Load an SSH key file that was previously generated using ssh-keygen. This command loads RSA (SSH version 2), or ECDSA (SSH version 2).
```
[edit]
root@host# set system root-authentication load-key-file url:filename
```
Set the log-key-changes configuration statement to log when SSH authentication keys are added or removed.
```
[edit]
root@host# set system services ssh log-key-changes
```
Note:
When the log-key-changes configuration statement is enabled and committed (with the commit command in configuration mode), Junos OS logs the changes to the set of authorized SSH keys for each user (including the keys that were added or removed). Junos OS logs the differences since the last time the log-key-changes configuration statement was enabled. If the log-key-changes configuration statement was never enabled, then Junos OS logs all the authorized SSH keys.
Commit the changes.
```
[edit]
root@host# commit
```

Note:

The root password should be reset following the change to sha256 / sha512 for the password storage format. This ensures the new password is protected using a sha256 / sha512 hash, rather than the default password hashing algorithm. To reset the root password, use the set system root-authentication plain-text-password password command, and confirm the new password when prompted.

arrow_backward PREVIOUS Understanding the Associated Password Rules for an Authorized Administrator

NEXT arrow_forward Configuring a System Login Message and Announcement

Common Criteria Configuration Guide for NFX350 Network Services Platform

Configuring a Network Device collaborative Protection Profile for an Authorized Administrator

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Common Criteria Configuration Guide for NFX350 Network Services Platform

Configuring a Network Device collaborative Protection Profile for an Authorized Administrator

Related Documentation

Stay in touch