Verified Exec (also known as veriexec) is a file-signing and verification scheme that protects the Junos operating system (OS) against unauthorized software and activity that might compromise the integrity of your device. Originally developed for the NetBSD OS, veriexec was adapted for Junos OS and enabled by default from Junos OS Release 7.5 onward.
Authorized files, that is certain files that ship with Junos, have an associated fingerprint that veriexec checks to determine whether the file can be used (executed, or even opened). Any file which lacks a valid fingerprint cannot be executed or read by applications that require verified input.
Note that /bin/sh does not require verified input. It can be used to run arbitrary scripts because from a risk perspective, they are the same as interactive commands, which is already controlled through user authentication and permissions. However, if a verified shell script contains instructions to run an arbitrary script, that is, a file that does not have a signature in the manifest, execution of that file will be prevented.
How Veriexec Works
Veriexec provides the kernel with a digitally signed manifest consisting of a set of fingerprints for all the executables and other files that should remain immutable. The veriexec loader feeds the contents of the manifest to the kernel only if the digital signature of the manifest is successfully verified. The kernel can then verify if a file matches its fingerprint. If veriexec is being enforced, only executables with a verified fingerprint will run. The protected files cannot be written to, modified, or changed.
Each install image contains a manifest. The manifest is read-only. It contains entries such as the following:
etc/rc sha1=478eeda6750c455fbfc18eeb06093e32a341911b uid=0 gid=0 mode=644 etc/rc.verify sha1=15566bb2731abee890fabd0ae8799e02071e006c uid=0 gid=0 mode=644 usr/libexec/veriexec-ext.so.1 sha1=8929292d008d12cd5beb2b9d9537458d4974dd22 uid=0 gid=0 mode=550 no_fips sbin/verify-sig sha1=cd3ffd45f30f1f9441e1d4a366955d8e2c284834 uid=0 gid=0 mode=555 no_ptrace sbin/veriexec sha1=7b40c1eae9658f4a450eb1aa3df74506be701baf uid=0 gid=0 mode=555 no_ptrace jail/usr/bin/php sha1=c444144fef5d65f7bbc376dc3ebb24373f1433a2 uid=0 gid=0 mode=555 indirect no_fips usr/sbin/chassisd sha1=61b82b36da9c6fb7eeb413d809ae2764a8a3cebc uid=0 gid=0 mode=555 trusted
If a file has been modified and the resulting fingerprint differs from the one in the manifest, you will see a log message, such as the following example:
/kernel:veriexec:fingerprintfordev100728577,file70750 64ea873ed0ca43b113f87fa25fb30f9f60030cec!= 0d9457c041bb3646eb4b9708ba605facb84a2cd0
The log message is in the following format:
The fingerprint mismatch indicates that the file has been modified. Don’t try to run the file. It could contain corrupted code. Contact JTAC.
The Importance of Veriexec
Veriexec is an effective and important tool for protecting against those seeking to breach the system security of Juniper Networks routers, switches, and firewalls. It thwarts threat actors who might want to establish a foothold on the system, gain persistent unauthorized access, or otherwise transition the system into a failure state. If such actors can run arbitrary unsigned binaries, they can make unauthorized modifications and run malware or other code that violates security policy.
Customers can add signed and authorized code with veriexec enforced to Junos OS by using the JET SDK. For more on the SDK solution, see On-Device Applications in the Juniper Extension Toolkit Developer Guide.
How to Verify If Veriexec Is Enforced on a Device Running Junos OS
The following subsections give procedures on how to check if veriexec is enforced or not.
Some Junos OS platforms offer an optional version of Junos OS with veriexec enforcement disabled (referred to as Junos Enhanced Automation or Junos Flex). For more information about Junos Enhanced Automation, see Overview of Junos Automation Enhancements on Devices Running Junos OS with Enhanced Automation.
Use the sysctl security.mac.veriexec.state Command for Junos OS Release 15.1 and Later
Administrators can check whether veriexec is enforced by running the following commands from the Junos CLI shell:
- Start the shell.
username@hostname> start shell
- Use the
% sysctl security.mac.veriexec.state
security.mac.veriexec.state: loaded active enforce %
If veriexec is enforced, the output is security.mac.veriexec.state: loaded active enforce. If veriexec is not enforced, the output is security.mac.veriexec.state: loaded active.
is only valid in Junos OS Release 15.1 and later.
Another Way to Check If Veriexec Is Working
You can confirm whether veriexec is working by copying an authorized file (here, /usr/bin/id), to a new location as shown below. Veriexec prevents the operation because, although there is a valid fingerprint for /usr/bin/id, there is no fingerprint for /tmp/id even though the file is identical. What is happening is that veriexec evaluates the underlying Linux properties of the file, which are not identical after being copied, rather than the file itself.
- Start the shell.
username@hostname> start shell
- Change directories and then copy the example file,
/usr/bin/idto a new location.
# /usr/bin/id uid=928(username) gid=20 groups=20,0(wheel),10(field)
# cp /usr/bin/id /tmp
If veriexec is being enforced, an Authentication error appears. If it is not, the file will be run as normal.
Output when veriexec is enforced (the file is blocked):
# /tmp/id /bin/sh: /tmp/id: Authentication error #
Output when veriexec is not enforced (the file is copied):
# /tmp/id #
Veriexec Capable Loader for SRX Series devices
Veriexec capable loader installs Junos OS image using install command from TFTP server and USB storage device.
Install Junos OS image from tftp server using the install tftp://[host]/ install command.
loader> install tftp://[host]/package
Install Junos OS image from USB storage device using the install file:/// install command.
loader> install file:///package
Veriexec capable loader validates the Junos OS image. Veriexec capable loader boots up only new Junos OS image with fingerprints and does not bootup existing Junos OS image without fingerprints or kernel. You can use the nextboot function to check the current bootup device.
Platform: srx-sword eUSB usb current bootdev is: eUSB
Bootupgrade is a tool available in the Junos OS package to support BIOS firmware upgrading. You can use the bootupgrade command to upgrade, check uboot, manually load, and to install larger size veriexec capable loader. The bootupgrade -c loader command prints version string for current loader.
Before you install veriexec capable loader to Junos OS image, a Junos OS fingerprints identification is carried out in both dual-root partitions. Only when both dual-root partitions have Junos OS with fingerprints, the veriexec capable loader installation is allowed.
Install veriexec capable loader from the Junos CLI shell:
- Start the shell.
username@hostname> start shell
- Use the
bootupgrade -l /boot/veloadercommand to install veriexec capable loader.
% bootupgrade -l /boot/veloader
Checking Loader CRC... veloader size 1251641 OK
- You can see different scenarios here:
For Junos OS Release 20.3R1 and later, use request system software add /var/tmp/xxx.tgz no-copy no-validate command to install Junos OS with fingerprints normally.
username@hostname> request system software add /var/tmp/junos-srxsme-20.4I-20200810_dev_common.0.0833.tgz no-copy no-validate
Formatting alternate root (/dev/ad0s2a)... /dev/ad0s2a: 600.0MB (1228732 sectors) block size 16384, fragment size 2048 using 4 cylinder groups of 150.00MB, 9600 blks, 19200 inodes. super-block backups (for fsck -b #) at: 32, 307232, 614432, 921632 Installing package '/altroot/cf/packages/install-tmp/junos-20.4I-20200810_dev_common.0.0833' ... Verified junos-boot-srxsme.tgz signed by PackageDevelopmentECP256_2020 method ECDSA256+SHA256 Verified junos-srxsme-domestic signed by PackageDevelopmentECP256_2020 method ECDSA256+SHA256 Verified manifest signed by PackageDevelopmentECP256_2020 method ECDSA256+SHA256 WARNING: The software that is being installed has limited support. WARNING: Run 'file show /etc/notices/unsupported.txt' for details. JUNOS 20.4I-20200810_dev_common.0.0833 will become active at next reboot WARNING: A reboot is required to load this software correctly WARNING: Use the 'request system reboot' command WARNING: when software installation is complete Saving state for rollback ...
For Junos OS Releases prior to 20.3R1, if veriexec capable loader is in use and the target Junos OS image for previous releases are not supported by veriexec capable loader, then use request system software add /var/tmp/xxx.tgz no-copy no-validate command to automatically downgrade to old loader from veriexec capable loader.
username@hostname> request system software add /var/tmp/junos-srxsme-19.4R1.3.tgz no-copy no-validate
WARNING: Package junos-19.4R1.3 version 19.4R1.3 is not compatible with current loader WARNING: Automatic recovering loader, please wait ... Upgrading Loader... ##################################### Verifying the loader image... OK WARNING: The new boot firmware will take effect when the system is rebooted. WARNING: Loader recover finish. Formatting alternate root (/dev/ad0s1a)... /dev/ad0s1a: 598.5MB (1225692 sectors) block size 16384, fragment size 2048 using 4 cylinder groups of 149.62MB, 9576 blks, 19200 inodes. super-block backups (for fsck -b #) at: 32, 306464, 612896, 919328 Installing package '/altroot/cf/packages/install-tmp/junos-19.4R1.3' ... Verified junos-boot-srxsme-19.4R1.3.tgz signed by PackageProductionEc_2019 method ECDSA256+SHA256 Verified junos-srxsme-19.4R1.3-domestic signed by PackageProductionEc_2019 method ECDSA256+SHA256 Verified junos-boot-srxsme-19.4R1.3.tgz signed by PackageProductionEc_2019 method ECDSA256+SHA256 V erified junos-srxsme-19.4R1.3-domestic signed by PackageProductionEc_2019 method ECDSA256+SHA256 JUNOS 19.4R1.3 will become active at next reboot WARNING: A reboot is required to load this software correctly WARNING: Use the 'request system reboot' command WARNING: when software installation is complete Saving state for rollback ...
Use requestsystemsoftwareadd/var/tmp/xxx to check whether the Junos package is compatible for the installation.
username@hostname> request system software add /var/tmp/junos-srxsme-19.4R2.3.tgz
WARNING: Package junos-19.4R2.3 version 19.4R2.3 is not compatible with this system. WARNING: Please install a package with veloadr support, 20.3 or higher.
The installation is terminated because veriexec capable loader is not supported for Junos OS Releases prior to 20.3R1.