3

I have a bit of an odd question that I can't seem to find much success in getting an answer via web searching.

I'm wondering if there is a way to secure the J-Web interface with user lockouts after multiple bad login attempts (similar to what can be achieved when accessing the CLI terminal via SSH or Telnet).

I have provided an example configuration for SSH to illustrate what I am trying to achieve for securing the J-Web interface.

system {
    login {
        retry-options {
            tries-before-disconnect 3;
            backoff-threshold 1;
            backoff-factor 5;
            lockout-period 1440;
        }
    }
    services {
        ssh {
            root-login allow;
            max-sessions-per-connection 1;
        }
    }
}

In addition, I have found that a user locked out via terminal will not get locked out via J-Web. Which makes me feel like the web management portal probably runs on a completely different security model than the terminal.

I thought I would seek expert advice. Thanks in advance.

EDIT:

If it makes a difference, I am looking to configure this for our SRX series devices.

1
  • As the answer below hints, you should probably disable the HTTP access. That is an absolute requirement from our security team for any network infrastructure device.
    – Ron Maupin
    Jan 4 '19 at 15:02
2

Little reading documentation say we can limit on Juniper devices sessions and timeouts for sessions. Check this documentation there But be aware this document mean that you use (v)SRX devices.

Also there is exist lockout-period minutes; see documentation there but yep it's not say that this option limit logins through all management services: ssh, telnet, web.

Even better solution: disable web management service

Also be good if you check documentation for your model of Juniper.

UPD:

There similar question on the juniper forum dated 2015 year There no similar limit for J-web as exist for ssh/telnet services.

So good way it's limit sessions and sessions timeouts, use https, setup ip's which acceptable to access management interfaces.

5
  • I'm afraid this is not the answer I am looking for. I'm looking to configure the number of bad login attempts and set a lockout -- not to limit the number of sessions.
    – Svek
    Jan 4 '19 at 11:16
  • Also, the lockout-period (you noted as your second reference) is part of the same hierarchy I showed in my sample configuration [edit system login retry-options]. It does not apply to web (as you stated in your answer).
    – Svek
    Jan 4 '19 at 11:18
  • @Svek Be good if you say model of Juniper which you use. I know that this not full answer, but point of start. Jan 4 '19 at 11:19
  • Good point. I did not state that I needed a configuration for an SRX series.
    – Svek
    Jan 4 '19 at 11:20
  • 1
    @Svek Please check my update. Jan 4 '19 at 13:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.