close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Overview
play_arrow Configuring Administrative Credentials and Privileges
- Understanding the Associated Password Rules for an Authorized Administrator
play_arrow Configuring Roles and Authentication Methods
play_arrow Configuring SSH and Console Connection
- Configuring SSH on the Evaluated Configuration for FIPS
play_arrow Configuring MACsec
- Understanding Media Access Control Security (MACsec) in FIPS mode
- Configuring MACsec
play_arrow Configuring Event Logging
play_arrow Performing Self-Tests on a Device
- Understanding FIPS Self-Tests
- Example: Configure FIPS Self-Tests
play_arrow Operational Commands
- request system zeroize
- request vmhost zeroize no-forwarding

list Table of Contents

English

Configuring Crypto Officer and FIPS User Identification and Access

date_range 23-Sep-21

arrow_backward

arrow_forward

Crypto Officer enables FIPS mode on your device and performs all configuration tasks for Junos OS in FIPS mode and issue all Junos OS in FIPS mode statements and commands. Crypto Officer and FIPS user configurations must follow Junos OS in FIPS mode guidelines.

Configuring Crypto Officer Access

Junos OS in FIPS mode offers a finer granularity of user permissions than those mandated by FIPS 140-2.

For FIPS 140-2 compliance, any FIPS user with the secret, security, maintenance, and control permission bits set is a Crypto Officer. In most cases the super-user class suffices for the Crypto Officer.

To configure login access for a Crypto Officer:

Log in to the device with the root password if you have not already done so, and enter configuration mode:
```
root@hostname> edit
Entering configuration mode
[edit]
root@hostname# 
```
Name the user crypto-officer and assign the Crypto Officer a user ID (for example, 6400, which must be a unique number associated with the login account in the range of 100 through 64000) and a class (for example, super-user). When you assign the class, you assign the permissions—for example, secret, security, maintenance, and control.
For a list of permissions, see Understanding Junos OS Access Privilege Levels.
```
[edit]
root@hostname# set system login user username uid value class class-name
```
For example:
```
[edit]
root@hostname# set system login user crypto-officer uid 6400 class super-user
```
Following the guidelines in Understanding Password Specifications and Guidelines for Junos OS in FIPS Mode, assign the Crypto Officer a plain-text password for login authentication. Set the password by typing a password after the prompts New password and Retype new password.
```
[edit]
root@hostname#  set system login user username class class-name authentication (plain-test-password | encrypted-password)
```
For example:
```
[edit]
root@hostname#  set system login user crypto-officer class super-user authentication plain-text-password
```

Optionally, display the configuration:

content_copy zoom_out_map
[edit]
root@hostname#edit system
[edit system]
root@hostname#show
login {
    user crypto-officer {
        uid 6400;
        authentication {
            encrypted-password "<cipher-text>"; ## SECRET-DATA
        }
        class super-user; 
    }
}

If you are finished configuring the device, commit the configuration and exit:
```
[edit]
root@hostname# commit
commit complete
root@hostname# exit
```

Configuring FIPS User Login Access

A fips-user is defined as any FIPS user that does not have the secret, security, maintenance, and control permission bits set.

As the Crypto Officer you set up FIPS users. FIPS users cannot be granted permissions normally reserved for the Crypto Officer—for example, permission to zeroize the system.

To configure login access for a FIPS user:

Log in to the device with your Crypto Officer password if you have not already done so, and enter configuration mode:
```
crypto-officer@hostname:fips> edit
Entering configuration mode
[edit]
crypto-officer@hostname:fips#
```
Give the user, a username, and assign the user a user ID (for example, 6401, which must be a unique number in the range of 1 through 64000) and a class. When you assign the class, you assign the permissions—for example, clear, network, resetview, and view-configuration.
```
[edit]
crypto-officer@hostname:fips# set system login user username uid value class class-name
```
For example:
```
[edit]
crypto-officer@hostname:fips# set system login user fips-user1 uid 6401 class read-only 
```
Following the guidelines in Understanding Password Specifications and Guidelines for Junos OS in FIPS Mode, assign the FIPS user a plain-text password for login authentication. Set the password by typing a password after the prompts New password and Retype new password.
```
[edit]
crypto-officer@hostname:fips# set system login user username class class-name authentication (plain-text-password | encrypted-password)
```
For example:
```
[edit]
crypto-officer@hostname:fips# set system login user fips-user1 class read-only authentication plain-text-password
```

Optionally, display the configuration:

content_copy zoom_out_map
[edit]
crypto-officer@hostname:fips# edit system
[edit system]
crypto-officer@hostname:fips# show
login {
    user fips-user1 {
        uid 6401;
        authentication {
            encrypted-password "<cipher-text>"; ## SECRET-DATA
        }
        class read-only;
    }
}

If you are finished configuring the device, commit the configuration and exit:
```
[edit]
crypto-officer@hostname:fips# commit
crypto-officer@hostname:fips#  exit
```

arrow_backward PREVIOUS Enabling FIPS Mode

NEXT arrow_forward Configuring SSH on the Evaluated Configuration for FIPS

FIPS Evaluated Configuration Guide for MX2010 and MX2020 Devices

ON THIS PAGE

Configuring Crypto Officer and FIPS User Identification and Access

Configuring Crypto Officer Access

Configuring FIPS User Login Access

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

FIPS Evaluated Configuration Guide for MX2010 and MX2020 Devices

ON THIS PAGE

Configuring Crypto Officer and FIPS User Identification and Access

Configuring Crypto Officer Access

Configuring FIPS User Login Access

Related Documentation

Stay in touch