In the event that communications with the events server is lost, the Juniper SRX Services Gateway must continue to queue log records locally.

From Juniper SRX SG NDM Security Technical Implementation Guide

Part of SRG-APP-000109-NDM-000233

Associated with: CCI-000140

SV-80971r1_rule In the event that communications with the events server is lost, the Juniper SRX Services Gateway must continue to queue log records locally.

Vulnerability discussion

It is critical that when the network device is at risk of failing to process logs as required, it take action to mitigate the failure. Log processing failures include: software/hardware errors; failures in the log capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to log failure depend upon the nature of the failure mode. Since availability is an overriding concern given the role of the Juniper SRX in the enterprise, the system must not be configured to shut down in the event of a log processing failure. The system will be configured to log events to local files, which will provide a log backup. If communication with the Syslog server is lost or the server fails, the network device must continue to queue log records locally. Upon restoration of the connection to the centralized collection server, action should be taken to synchronize the local log data with the collection server.A best practice is to add log-prefixes to the log file names to help in researching the events and filters to prevent log overload. Another best practice is to add a match condition to limit the recorded events to those containing the regular expression (REGEX). Thus, the Juniper SRX will inherently and continuously capture events to local files to guard against the loss of connectivity to the primary and secondary events server.

Check content

Verify logging has been enabled and configured to capture to local log files in case connection with the primary and secondary log servers is lost. [edit] show system syslog If local log files are not configured to capture events, this is a finding.

Fix text

The following example commands configure local backup files to capture DoD-defined auditable events. [edit] set system syslog file messages any info set system syslog file messages authorization none set system syslog file messages interactive-commands none set system syslog file messages daemon none set system syslog file User-Auth authorization any set system syslog file interactive-commands interactive-commands any set system syslog file processes daemon any set system syslog file account-actions change-log any any set file account-actions match “system login user” set system syslog console any any

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer