CC FIPS Documentation #651

Chr1st0ph3rTurn3r · 2023-12-19T20:35:50Z

No description provided.

MichaelBaj · 2023-12-19T21:20:48Z

docs/cc_fips_sec_firewall_filtering.md

@@ -0,0 +1,288 @@
+---


This document is the same that is already published correct? Rather than duplicate, please make it a module that is imported instead.

One of the requirements for the CC FIPS docs is that they are versioned, which would lock it. If we use the existing docs as links, then we cannot guarantee that the documentation won't change. So the individual files, specifically for this version of software are copied into the doc and not updated with the rest of the documentation.

If we could have a separate location just for this doc, that would be better, and solve the issue of someone coming across it.

Please keep in mind that CC and FIPS are completely independent of each other. The only reason FIPS is a part of this is because we require that FIPS mode is enabled on the SSR. I would suggest renaming the PR to not include FIPS

One of the requirements for the CC FIPS docs is that they are versioned

An alternative proposed by Teron is that we publish a PDF of the CC-specific doc, which is a snapshot in time of the common web-based doc content for FIPS.

That PDF can then be given a specific version number and posted as a standalone doc, along with the CC ST and guidance documents, which also must be similarly version controlled.

MichaelBaj · 2023-12-19T21:22:03Z

docs/cc_fips_titlepage.md

+sidebar_label: SSR Common Criteria and FIPS Installation and User Guide
+---
+
+This guide provides installation and configuration information for using SSR Conductors and Routers in a certified Common Criteria and FIPS environment. 


While this introduction might be sufficient for those well versed in CC, this may not be sufficient for those navigating here without prior knowledge. A better introduction as to why a customer would chose to deploy in this fashion would be helpful.

MichaelBaj · 2023-12-19T21:22:15Z

docs/cc_fips_router_install.md

@@ -0,0 +1,217 @@
+---


This document is the same that is already published correct? Rather than duplicate, please make it a module that is imported instead.

MichaelBaj · 2023-12-19T21:24:00Z

docs/cc_fips_config_password_policies.md

@@ -0,0 +1,39 @@
+---
+title: Username and Password Policies


This document is the same that is already published correct? Rather than duplicate, please make it a module that is imported instead.

@MichaelBaj one of the requirements for this documentation is that it must be versioned. Meaning that once we get SSR CC certified with a particular version and with this specific Guidance doc, it must not be changeable. I am all for reusing this as a module, but it also must be frozen in time,

MichaelBaj · 2023-12-19T21:24:09Z

docs/cc_fips_conductor_install.md

@@ -0,0 +1,316 @@
+---


This document is the same that is already published correct? Rather than duplicate, please make it a module that is imported instead.

All CC documents must be immutable i.e. snapshot or standalone versioned documents, and cannot be updated after publishing without invalidating the CC compliance. i.e. the exact docs used during CC verification must remain available indefinitely and unmodified, it's not permitted to reference CI/CD docs such as our online web pages.

…nd breaking intro into two topics

MichaelBaj · 2023-12-20T19:40:30Z

docs/cc_fips_router_install.md

-  :::note
-  A system reboot is required.
-  :::---->
+<!------->


Why is this here?

migolnikov · 2023-12-20T21:32:09Z

docs/cc_fips_compliance_guidelines.md

+For compliance, the following configuration considerations must be made:
+
+- FIPS mode must be enabled **during installation**.
+- All configuration procedures must be performed from the PCLI; use of the GUI is not part of the approved use case.


the distinction is GUI is allowed during the initial setup process.

migolnikov · 2023-12-20T21:33:56Z

docs/cc_fips_compliance_guidelines.md

+- When installing a router, the [ICMP Session Match](cc_fips_sec_firewall_filtering.md#from-the-command-line) must be set to `identifier-and-type`.
+- Configure the [TCP Half-Open Connections Limit](cc_fips_sec_firewall_filtering.md#tcp-half-open-connection-limit) for firewall.
+- The `password-policy` must define the minimum password length and maximum number of permitted login attempts per user. Please refer to [`configure authority password-policy`](config_command_guide.md#configure-authority-password-policy) for pcli commands and context for assigning these values.
+- Traffic logging must be enabled by setting the following command to `true`: 


This is a very performance affecting setting. Users should not expect to run more than a handful of sessions while traffic icsa events are being collected.

migolnikov · 2023-12-20T21:34:41Z

docs/cc_fips_compliance_guidelines.md

+
+- Non-Juniper branded hardware platforms and Juniper branded hardware platforms not explicitly included.
+- Juniper SSR Software for virtual platforms.
+- HTTPS/TLS, IPSec, SNMP, RADIUS.


no LDAP either. Basically nothing that uses TLS or IPSec

migolnikov · 2023-12-20T21:39:20Z

docs/cc_fips_config_password_policies.md

@@ -0,0 +1,39 @@
+---
+title: Username and Password Policies


@MichaelBaj one of the requirements for this documentation is that it must be versioned. Meaning that once we get SSR CC certified with a particular version and with this specific Guidance doc, it must not be changeable. I am all for reusing this as a module, but it also must be frozen in time,

migolnikov · 2023-12-20T21:40:22Z

docs/cc_fips_titlepage.md

@@ -0,0 +1,20 @@
+---
+title: SSR Common Criteria and FIPS Installation and User Guide


is this replacing our standard fips docs?

no. I was under the assumption that CC and FIPS were tied together as part of a certification, hence the doc reflects that. I am changing it all in the next push.

iwbarker · 2023-12-21T13:52:24Z

docs/cc_fips_conductor_install.md

+
+For serial console issues please refer to [Serial Console Troubleshooting](ts_serial_console_tsing.md).
+
+#### Install via VGA Console


None of the CC certified platforms has a VGA does it?
I think we use serial console on all the qualified SSR platforms, so this can be omitted for CC.

iwbarker · 2023-12-21T13:53:12Z

docs/cc_fips_conductor_install.md

+
+3. Press **Enter** to start the install. 
+
+## Conductor Installation 


@migolnikov are we including conductor in CC?
Is conductor running on one of the CC qualified SSR platforms ?

Yes, conductor is included as a separate device. This is the distributed platform decision we made. There is no reason conductor cannot run on Juniper branded hardware.

iwbarker · 2023-12-21T13:56:15Z

static/img/cc_fips_serial_conductor.png

This is the UEFI VGA, not the BIOS Serial.
Please replace with the 'blue' screenshot for fips serial.

docs/cc_fips_compliance_guidelines.md

iwbarker · 2023-12-21T13:58:33Z

docs/cc_fips_compliance_guidelines.md

+
+## Out of Scope Features
+
+The following functionality and platforms are not supported under Common Criteria.


"not supported" -> "not permitted" ?

Or "not approved for common ctriteria" or "not certified"

iwbarker · 2023-12-21T14:02:03Z

static/img/install_serial_conductor_interactive1.png

mixed up titles for these img ?
this one is install VGA interactive, not install serial interactive

iwbarker

screenshots and cc-specific details need fixing as noted inline

iwbarker · 2023-12-21T19:33:15Z

docs/cc_fips_conductor_install.md

+
+Upon boot, the following screen is displayed. The default selection is booting to the serial console (115200 baud). You must manually choose the installation process suited for your environment.
+
+![Select Serial Install](/img/cc_fips_serial_install1.png)


I think we should remove 27..34 here, and move 35 down to after 44

…t is and is not a plugin.Merge branch 'kagrawal/refactor-monitoring-plugin-docs' into cc-fips-documentation

…e plugin doc.

MichaelBaj · 2024-03-19T20:32:37Z

docs/cc_fips_titlepage.md

+- Release Date: December 15, 2023
+
+Supported Hardware (must have Software Version 6.2.3-14-R2 installed):
+- SSR 120, SSR 130


This is a stylistic question, why break these systems up on these two bulleted lines? This was done to separate the low-end vs the high-end, but I don't think that matters in this context. I would recommend just listed each device on its own bulleted line.

MichaelBaj · 2024-03-19T20:33:17Z

docs/cc_fips_titlepage.md

+
+| Document Revision | Modification | Date |
+| --- | --- | --- |
+| 0.1 | Initial version for 6.2.3-R2 Common Criteria | December 31, 2023 |


Do these pre-release drafts each need to be documented, even following receipt of CC certification?

No, once finalized it will read only: | 1.0 | Initial version for 6.2.3-R2-14 Common Criteria | March 22, 20023 |

MichaelBaj · 2024-03-19T20:35:10Z

docs/cc_fips_intro.md

+
+Common Criteria for information technology is an international agreement signed by several countries that permits the evaluation of security products against a common set of standards. In the Common Criteria Recognition Arrangement (CCRA) at http://www.commoncriteriaportal.org/, the participants agree to mutually recognize evaluations of products performed in other countries. All evaluations are performed using a common methodology for information technology security evaluation.
+
+For more information on Common Criteria, see http://www.commoncriteriaportal.org/.


This URL is listed twice within two sentences. I would remove the first instance.

MichaelBaj · 2024-03-19T20:35:30Z

docs/cc_fips_intro.md

+
+The family of Juniper SSR appliances consists of the Session Smart Networking software executing on Juniper branded platforms. The compliant appliances include the following:
+
+- SSR 120, SSR 130


Each SSR device should be on its own line.

MichaelBaj · 2024-03-19T20:37:10Z

docs/cc_fips_intro.md

+- SSR 120, SSR 130
+- SSR 1200, SSR 1300, SSR 1400, SSR 1500
+
+The software is Juniper SSR software v6.2.3-14R2. The software is deployed in an ISO package file, which includes Enterprise Linux 7.9 with kernel version 4.18.0.


missing hyphen after 14 and R2

MichaelBaj · 2024-03-20T20:44:23Z

docs/cc_fips_config_audit_event.md

+
+1. Create an event collector input to capture the traffic events. An example input configuration is shown below.
+
+```toml


This is not part of the 128T config. Specify the file that contains this contents.

MichaelBaj · 2024-03-20T20:44:49Z

docs/cc_fips_config_audit_event.md

+
+2. Define an output for where the events are to be sent. In this example, the events are sent to a syslog server.
+
+```toml


This is not part of the 128T config. Specify the file that contains this contents.

MichaelBaj · 2024-03-20T20:44:49Z

docs/cc_fips_config_audit_event.md

+1. Create an event collector input to capture the traffic events. An example input configuration is shown below.
+
+```toml
+[[inputs.t128_events]]


This is not part of the 128T config. Specify the file that contains this contents.

MichaelBaj · 2024-03-20T20:46:21Z

docs/cc_fips_config_audit_event.md

+2024-03-14 21:35:10,274: INFO - Using Manifest package 128T-deprecated-packages-0:6.4.0.1.develop.el7-1.x86_64
+```
+
+### All Management Activities of TSF data 


Target of Evaluation (TOE) Security Functionality. Took me a long time to find that one... It now reads "All Management Activities of Security Functionality Data"

MichaelBaj · 2024-03-20T20:54:11Z

docs/cc_fips_software_upgrades.md

+Please refer to [Upgrade Considerations](https://www.juniper.net/documentation/us/en/software/session-smart-router/docs/intro_upgrade_considerations) before upgrading. 
+
+:::important
+**The SSH Root login is not permitted and is not compliant with Common Criteria guidelines.** If the existing version allows SSH Root login, it will be disabled during the upgrade. 


Logging in as root is not permitted and is not compliant with Common Criteria guidelines.

…e one current change locally that is conflicting. Merge branch 'cc-fips-documentation' of github.com:128technology/docs into cc-fips-documentation

MichaelBaj · 2024-03-21T19:43:08Z

docs/cc_fips_config_audit_event.md

 - Types of events available on the router
 - Enabling the Audit events

 ## Event Types
 The events generated by the router are classified into the following categories:

 ### Traffic Events 
-Traffic events are generated as sessions as created on the router. These include details such as the protocol, source address, source port, destination address and destination port. In addition, the success or failure status along with a reason code for failure cases are included in the event.
+Traffic events are generated as sessions created on the router. These include details such as the protocol, source address, source port, destination address and destination port. In addition, the success or failure status along with a reason code for failure cases are included in the event.


oops, I gave incorrect advice.
Traffic events are generated as sessions are created

Very old comments, all have been addressed. Need to push live, Max is out on vacation.

Chr1st0ph3rTurn3r added 5 commits December 15, 2023 16:33

starting common criteria docs

99c72a2

Common Criteria documentation start

12bf6dc

graphics updates

612d769

draft versions of install docs

29a0622

updated graphics

ce6ec31

Chr1st0ph3rTurn3r requested review from migolnikov, iwbarker and avijitvjuniper December 19, 2023 20:35

Chr1st0ph3rTurn3r requested a review from MichaelBaj as a code owner December 19, 2023 20:35

Merge branch 'master' into cc-fips-documentation

37e601c

MichaelBaj requested changes Dec 19, 2023

View reviewed changes

adding missing info per email from Teron, removing GUI config info, a…

b41aca9

…nd breaking intro into two topics

Chr1st0ph3rTurn3r requested a review from MichaelBaj December 20, 2023 19:07

MichaelBaj previously approved these changes Dec 20, 2023

View reviewed changes

docs/cc_fips_router_install.md Outdated

:::note

A system reboot is required.

:::---->



Copy link

Contributor

MichaelBaj Dec 20, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is this here?

migolnikov previously requested changes Dec 20, 2023

View reviewed changes

updates per review and additional info

52ff733

Chr1st0ph3rTurn3r dismissed MichaelBaj’s stale review via 52ff733 December 20, 2023 22:00

Merge branch 'master' into cc-fips-documentation

f9657bc

Chr1st0ph3rTurn3r requested review from migolnikov and MichaelBaj December 21, 2023 13:38

iwbarker reviewed Dec 21, 2023

View reviewed changes

docs/cc_fips_compliance_guidelines.md Outdated Show resolved Hide resolved

iwbarker reviewed Dec 21, 2023

View reviewed changes

iwbarker requested changes Dec 21, 2023

View reviewed changes

graphics updates, process updates, new topic.

193f8b2

Chr1st0ph3rTurn3r requested a review from iwbarker December 21, 2023 18:49

iwbarker reviewed Dec 21, 2023

View reviewed changes

Chr1st0ph3rTurn3r and others added 11 commits March 18, 2024 09:22

fixing missing link

99db225

version number

3412314

adding refactored monitoring agent info to reduce confusion about wha…

6a3e54a

…t is and is not a plugin.Merge branch 'kagrawal/refactor-monitoring-plugin-docs' into cc-fips-documentation

correcting the wording around Monitoring Agent and fixing links in th…

eafd97f

…e plugin doc.

trying to fix broken links

3e9972d

fix conflicts

db7ecb5

more removals

2977783

links still

aee41c3

link

a7b72cd

Merge branch 'master' into cc-fips-documentation

b75616d

Merge branch 'master' into cc-fips-documentation

37cb399

MichaelBaj requested changes Mar 20, 2024

View reviewed changes

Chr1st0ph3rTurn3r and others added 5 commits March 20, 2024 18:05

first of several updates to this doc.

d30b0bc

Merge branch 'master' into cc-fips-documentation

3a169cc

Merge branch 'master' into cc-fips-documentation

49d652e

merging changes in master into branch and merging those locally. Hav…

f9766eb

…e one current change locally that is conflicting. Merge branch 'cc-fips-documentation' of github.com:128technology/docs into cc-fips-documentation

updates with info from David Low, and Mike's review.

5c4971e

MichaelBaj self-requested a review March 21, 2024 19:40

MichaelBaj requested changes Mar 21, 2024

View reviewed changes

typo repair

1106764

MichaelBaj self-requested a review March 21, 2024 20:11

MichaelBaj previously approved these changes Mar 21, 2024

View reviewed changes

adding NIST compliance info

75782da

Chr1st0ph3rTurn3r dismissed MichaelBaj’s stale review via 75782da March 21, 2024 20:13

broken link

55be70d

Chr1st0ph3rTurn3r requested a review from MichaelBaj March 21, 2024 21:15

MichaelBaj approved these changes Mar 22, 2024

View reviewed changes

Chr1st0ph3rTurn3r merged commit 44ead45 into master Mar 22, 2024
1 check passed

Chr1st0ph3rTurn3r deleted the cc-fips-documentation branch March 22, 2024 15:01

		@@ -0,0 +1,20 @@
		---
		title: SSR Common Criteria and FIPS Installation and User Guide


		For serial console issues please refer to [Serial Console Troubleshooting](ts_serial_console_tsing.md).

		#### Install via VGA Console


		3. Press Enter to start the install.

		## Conductor Installation


		## Out of Scope Features

		The following functionality and platforms are not supported under Common Criteria.


		Upon boot, the following screen is displayed. The default selection is booting to the serial console (115200 baud). You must manually choose the installation process suited for your environment.

		![Select Serial Install](/img/cc_fips_serial_install1.png)


		Common Criteria for information technology is an international agreement signed by several countries that permits the evaluation of security products against a common set of standards. In the Common Criteria Recognition Arrangement (CCRA) at http://www.commoncriteriaportal.org/, the participants agree to mutually recognize evaluations of products performed in other countries. All evaluations are performed using a common methodology for information technology security evaluation.

		For more information on Common Criteria, see http://www.commoncriteriaportal.org/.


		The family of Juniper SSR appliances consists of the Session Smart Networking software executing on Juniper branded platforms. The compliant appliances include the following:

		- SSR 120, SSR 130


		1. Create an event collector input to capture the traffic events. An example input configuration is shown below.

		```toml


		2. Define an output for where the events are to be sent. In this example, the events are sent to a syslog server.

		```toml

CC FIPS Documentation #651

CC FIPS Documentation #651

Conversation

Chr1st0ph3rTurn3r commented Dec 19, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

iwbarker left a comment

Choose a reason for hiding this comment

iwbarker Dec 21, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

iwbarker Dec 21, 2023 •

edited

Loading