fir3net
PPS-Firenetbanner-780.5x190-30-03-17

Juniper SRX - How to Create a ReadOnly Account

 Within this article we will provide the necessary commands required to create a read-only account on a Juniper SRX. Within our example a user is created with the following attributes,

  • A user with the username of 'user1'.
  • ONLY allowed to use the show command.
  • SNMP configuration is REMOVED from the configuration output.
  • The policy-options and security address-book output is REMOVED from the configuration output.

Configuration

The configuration is pretty simple. A class is first created which defines what the user can do. Finally a user is then created and the class assigned.

Here is a breakdown of the class,

  • permissions - defines what contexts the user is allowed permission to. In this case it is everything other then SNMP.
  • allow-commands - defines what commands the user is permitted to perform under the contexts.
  • deny-commands - defines what commands the user is not permitted to perform under the contexts
  • deny-configuration - defines what configuration is excluded from the configuration output. i.e actual address books could be excluded via deny-configuration "(security address-book global address-set MGMT-IPS)";
login {
    class user1 {
        permissions [ admin interface routing security system ];
        allow-commands show;
        deny-commands "(clear)|(file)|(file show)|(help)|(load)|(monitor)|(op)|(request)|(save)|(set)|(start)|(user1)";
deny-configuration "(policy-options)|(security address-book)";
    }
    user user1 {
        uid 2007;
        class user1;
        authentication {
            encrypted-password "$1$u.5scwBy$wzCJgOIqu8LvIjB9CJco70"; ## SECRET-DATA
        }
    }
}

Commands

The actual commands to configure the above are shown below,

set system login class user1 permissions admin
set system login class user1 permissions interface
set system login class user1 permissions routing
set system login class user1 permissions security
set system login class user1 permissions system
set system login class user1 allow-commands show
set system login class user1 deny-commands "(clear)|(file)|(file show)|(help)|(load)|(monitor)|(op)|(request)|(save)|(set)|(start)|(user1)"
set system login class user1 deny-configuration "(policy-options)|(security address-book)"

set system login user user1 uid 2007
set system login user user1 class user1
set system login user user1 authentication plain-text-password // prompts you to enter password

Tags: Juniper, SRX

About the Author

RDonato

R Donato

Rick Donato is the Founder and Chief Editor of Fir3net.com. He currently works as a Principal Network Security Engineer and has a keen interest in automation and the cloud.

You can find Rick on Twitter @f3lix001