Discussion

performed on the router. As with Unix account names, the username must be unique
on the network and cannot contain spaces, colons, or commas.
This recipe configures an account for the username sage, who has a privilege level
operator, which allows her to perform most operational commands but not enter
configuration mode. operator is one of the predefined privilege classes. Recipe 2.10
explains the other predefined classes and how to create custom privilege classes.
The set user sage full-name command configures the user’s complete name. Setting
this is optional, but you may find it convenient or easier to read the person’s given
name rather than her account name when checking the configuration to see who has
access to a router. Enclose the full name in quotation marks if it contains spaces.
The third command, set user sage uid, assigns a user ID (UID) of 1991. The UID is
basically the same as the Unix UID. It’s included in the JUNOS configuration primarily
because UIDs are integral to Unix systems and the JUNOS software runs on
FreeBSD. As with Unix, the JUNOS software uses the UID when establishing and
enforcing file permissions and file access. Configuring the UID is optional. If you do
not configure it, the JUNOS software assigns one, generally using the lowest available
UID number, starting at 2000. Here’s an example of automatic assignment:
[edit system login]
aviva@router1# set user sage class operator
aviva@router1# commit check
configuration check succeeds
aviva@router1# show
user sage {
uid 2006;
class operator;
}
You see that UID 2006 has been assigned to the user sage. You might want to explicitly
configure the UID if users will be transferring files to Unix systems to ensure that
users have the same UID on both JUNOS and Unix systems so that there are no file
ownership issues.
The last command in this recipe establishes a plain-text password for the login
account. You are prompted for the password, and nothing is displayed when you
type and retype it.
To set up a user account, only the username and privilege class are required, but the
password and other information are optional. If you omit the class, the CLI displays
a warning:
[edit system login]
aviva@router1# set user sage full-name "sage david"
aviva@router1# show
user sage {
full-name "sage david";
## Warning: missing mandatory statement(s): 'class'
}
82 | Chapter 2: Basic Router Security and Access Control
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.