2025: SRX/IX firmware upgrade

[sorah]

[sorah]

delete system services ssh tcp-forwarding
delete system services ssh hostkey-algorithm
delete system services ssh ciphers chacha20-poly1305@openssh.com
set system services ssh hostkey-algorithm-list ed25519 ecdsa-sha2-nistp521

(chacha20-poly1305: https://supportportal.juniper.net/s/article/2024-01-Reference-Advisory-Junos-OS-and-Junos-OS-Evolved-Impact-of-Terrapin-SSH-Attack-CVE-2023-48795?language=en_US)

[sorah]

brはそもそも22.2R3-S2.8や…。

[sorah]

set security forwarding-options family inet mode packet-based

[sorah]

雑に以下のファイルを a.xml とかで保存して upgrade-using-config a.xml で断は避けられそうだ

    <configuration>
            <system>
                <services>
                    <ssh>
                        <hostkey-algorithm-list>
                            <ecdsa-sha2-nistp521/>
                            <ed25519/>
                        </hostkey-algorithm-list>
                    </ssh>
                </services>
            </system>

            <security>
                <forwarding-options>
                    <family>
                        <inet>
                            <mode>packet-based</mode>
                        </inet>

                    </family>
                </forwarding-options>
            </security>
    </configuration>

[hanazuki]

SRXについては済んでいそう