Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Veriexec File Signing and Verification for Junos OS

Learn about Veriexec file-signing and verification, benefits and how to use it.

Verified Exec (also known as veriexec) is a file-signing and verification scheme that protects the Junos operating system (OS) against unauthorized software and activity that might compromise the integrity of your device. Originally developed for the NetBSD OS, veriexec was adapted for Junos OS and is enabled by default.

Authorized files, that is certain files that ship with Junos OS, has an associated fingerprint that veriexec checks to determine whether the file can be used (executed or even opened). Any file which lacks a valid fingerprint cannot be executed or read by applications that require verified input.

The/bin/sh file does not require verified input. You can use this file to run arbitrary scripts. From a risk perspective, these scripts are the same as interactive commands, which are controlled through user authentication and permissions. However, if a verified shell script contains instructions to run an arbitrary script, that is, a file without a signature in the manifest, execution of that file is prevented.

How Veriexec Works

Veriexec provides the kernel with a digitally signed manifest consisting of a set of fingerprints for all the executables and other files that must remain immutable.The veriexec loader feeds the contents of the manifest to the kernel only if associated digital signatures of the manifest are successfully verified. The kernel can then verify if a file matches its fingerprint. If veriexec is enforced, only executables with a verified fingerprint will run. The protected files cannot be written to, modified, or changed.

Each installation image contains a manifest, which is a read-only file. It contains entries such as the following:

The log message is in the following format:

If a file has been modified and the resulting fingerprint differs from the one in the manifest, you see a log message, such as the following example:

Fingerprint mismatch indicates that the file has been modified. Don’t try to run such a file, as it could contain corrupted code. Contact JTAC for guidance.

Benefits of Veriexec

  • Secure systems—Safeguard Juniper Networks routers, switches, and firewalls from security breaches.

  • Prevent unauthorized access—Block threat actors from gaining persistent, unauthorized access or causing system failure.

  • Prevent malware execution—Block unauthorized modifications and malware through prevention of unsigned binary execution.

  • Support authorized code—Add signed, authorized code to Junos OS with veriexec enforcement using the JET SDK. For more information about the SDK solution, see Juniper Extension Toolkit Developer Guide.

How to Verify If Veriexec Works — Option 1

Some Junos OS platforms offer an optional version of Junos OS with veriexec enforcement disabled. For detailed information, see Junos Enhanced Automation.

Administrators can check whether veriexec is enforced by running the following commands from the Junos OS CLI shell:

  1. Start the shell.

  2. Use the sysctl security.mac.veriexec.state command for Junos OS Release 15.1 and Later

    If veriexec is enforced, the output is security.mac.veriexec.state: loaded active enforce. If veriexec is not enforced, the output is security.mac.veriexec.state: loaded active.

How to Verify If Veriexec Works — Option 2

You can confirm whether veriexec is working by copying an authorized file (for example, /usr/bin/id) to a new location as shown below. Veriexec prevents the operation, because even though the file is identical, a valid fingerprint exists only for /usr/bin/id, not for /tmp/id. To verify the file integrity, veriexec evaluates the underlying Linux properties of the file. These properties, rather than the file itself, change after you copy the file to another location.

  1. Start the shell.

  2. Change directories and then copy an authorized file, for example, /usr/bin/id, to a new location.

Results

If veriexec is being enforced, an authentication error message is generated. If an error message is not generated, the file will run as normal.

Output generated when veriexec is enforced, showing the file is blocked:

Output generated when veriexec is not enforced, showing the file is copied

Install Veriexec Loader

The veriexec loader validates the Junos OS image that you install from a Trivial File Transfer Protocol (TFTP) server or a USB storage device.

  • To install the Junos OS image from a TFTP server use this command:

  • Install the Junos OS image from a USB storage device using the following command.

The veriexec-capable loader validates the Junos OS image. The loader boots up only new Junos OS images with fingerprints and does not boot existing images without fingerprints or kernel. You can use the nextboot function to check the current bootup device.

Bootupgrade is a tool available in the Junos OS package to support BIOS firmware upgrading. You can use the bootupgrade command to upgrade, check U-Boot, manually load, and install the veriexec-capable loader. The bootupgrade -c loader command prints the version string for the current loader.

Before you install the veriexec-capable loader to a Junos OS image, identification of Junos OS fingerprints is carried out in both dual-root partitions. The veriexec capable loader can be installed only when both dual-root partitions have Junos OS with fingerprints.

Install the veriexec-capable loader from the Junos OS CLI shell:

  1. Start the shell.

  2. Use the bootupgrade -l /boot/veloader command to install the veriexec-capable loader.

  3. You can see different scenarios here:

    • Use request system software add /var/tmp/xxx.tgz no-copy no-validate command to install Junos OS with fingerprints.

    • If the veriexec-capable loader doesn't support the target Junos OS images of previous releases, you can downgrade to an earlier version of the the loader compatible with the release. Use the request system software add /var/tmp/xxx.tgz no-copy no-validate command to automatically downgrade to an earlier version of the loader.

    • Use the request system software add /var/tmp/xxx command to check whether the Junos OS package is compatible for the installation with the veriexec loader.

      In this example, you see that the installation is terminated because the veriexec loader is not supported for Junos OS Releases before 20.3R1.