Information
All user accounts must have a class set.
Rationale:
Controlling the level of access which users are granted when logging into a router, helps protect against both malicious attacks and accidental misconfiguration of the router by less experienced staff.
Configuring user permissions on a user by user basis can quickly become unwieldy and difficult to manage, potentially leading to mistakes with a serious impact on the routers security. Instead, permissions should be assigned to classes to which individual users are linked in order to grant the appropriate level of access that corresponds with their job role.
JUNOS provides 4 built in Login Classes:
- Operator (can perform operational commands like ping but cannot view or edit the configuration or reboot the device)
- read-only (can view configuration and perform some operational commands)
- super-user (can issue any command)
- unauthorized (can login, but cannot perform any actions except for logging out)
In addition to the built in classes, JUNOS allows administrators to configure Custom Login Classes and to permit or deny additional permissions through Vendor Specific Attributes used with External AAA Servers like RADIUS or TACACS+.
Because a user account, whether being used for a local user or used as a template for logins from External AAA, will be placed in the highly privileged `super-user' class by default - it is essential that all user accounts be explicitly configured with the required login class, even when further restrictions are being applied through permit/deny commands by External AAA.
Solution
Configure a class for a user account using the following command under the [edit system login] hierarchy:
[edit system login]
user@host#set user <username> class <class name>
Default Value:
By default all users are, in effect, members of the super-user class.