Discussion

individual user accounts with passwords on the router so someone can always log in
to the router (see Recipe 2.5).
See Also
Recipes 2.4, 2.5, 2.10, and 2.13
2.10 Customizing Account Privileges
Problem
You want to create a custom privilege class to define the operations and actions a
user can perform while logged in to the router.
Solution
Create a privilege class that allows users to read but not modify the configuration
and then let them perform all operational mode commands:
[edit system login]
aviva@router1# set class operator-plus-read-config permissions [ admin clear
configure floppy interface network reset routing shell snmp system trace view
maintenance firewall rollback security ]
Discussion
When you set up login accounts on the router (see Recipe 2.5), each account must
have a privilege level, or class, which defines the operations and actions the user
can and cannot perform on the router. Each privilege level consists of a collection
of permission bits that specifies what a user is allowed to do. Table 2-1 lists all the
permission bits.
Table 2-1. Login class permissions
Permission
All (superuser)
Delete data from system log, tracing,
and other files
All control-level operations (bits ending
in -control)
Configure the router
Access removable media
Halt and reboot the router; start a
shell and become superuser
Access the network
Start and stop software processes
Bit name
all (can perform all actions)
clear (using the clear commands)
control (can view and change all portions of the configuration)
configure (using the configure and commit commands)
floppy
maintenance (using the request system commands, and using the CLI
start shell command and the su root command)
network (using the ping, ssh, telnet, and traceroute commands)
reset (using the restart command, and configure at [edit system
processes])
Customizing Account Privileges | 89
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.