Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Configuring Crypto Officer and FIPS User Identification and Access

Crypto Officers and FIPS users perform all configuration tasks for Junos OS Evolved in FIPS mode and issue all Junos OS Evolved in FIPS mode statements and commands. Crypto Officer and FIPS user configurations must follow Junos OS Evolved in FIPS mode guidelines.

Configuring Crypto Officer Access

Junos OS Evolved in FIPS mode offers a finer granularity of user permissions than those mandated by FIPS 140-3.

For FIPS 140-3 compliance, any FIPS user with the secret, security, maintenance, and control permission bits set is a Crypto Officer. In most cases the super-user class suffices for the Crypto Officer.

To configure login access for a Crypto Officer:

  1. Log in to the router with the root password if you have not already done so, and enter configuration mode:
  2. Name the user crypto-officer and assign the Crypto Officer a user ID (for example, 6400, which must be a unique number associated with the login account in the range of 100 through 64000) and a class (for example, super-user). When you assign the class, you assign the permissions—for example, secret, security, maintenance, and control.

    For a list of permissions, see Understanding Roles and Services for Junos OS Evolved in FIPS.

    For example:

  3. Following the guidelines in What Is Expected of All FIPS Users, assign the Crypto Officer a plain-text password for login authentication. Set the password by typing a password after the prompts New password and Retype new password.

    For example:

  4. Optionally, display the configuration:
  5. If you are finished configuring the router, commit the configuration and exit:

    Otherwise, go on to Configuring FIPS User Login Access.

Configuring FIPS User Login Access

A fips-user is defined as any FIPS user that does not have the secret, security, maintenance, and control permission bits set.

As the Crypto Officer you set up FIPS users. FIPS users cannot be granted permissions normally reserved for the Crypto Officer—for example, permission to zeroize the system.

To configure login access for a FIPS user:

  1. Log in to the router with your Crypto Officer password if you have not already done so, and enter configuration mode:
  2. Give the user, a username, and assign the user a user ID (for example, 6401, which must be a unique number in the range of 1 through 64000) and a class. When you assign the class, you assign the permissions—for example, clear, configure, network, resetview, and view-configuration.

    For a list of permissions, see Understanding Roles and Services for Junos OS Evolved in FIPS.

  3. Following the guidelines in What Is Expected of All FIPS Users, assign the FIPS user a plain-text password for login authentication. Set the password by typing a password after the prompts New password and Retype new password.
  4. Optionally, display the configuration:
  5. If you are finished configuring the router, commit the configuration and exit:

Related Documentation