Discussion

192.168.15.2;
}
##
## login: Names, login classes, and passwords for users
## require: admin
##
login {
##
## Login class name
## match (regex): ^[[:alnum:]_-]+$
##
The only way to find out the permissions for operational mode commands is to look
in the JUNOS product documentation.
Login classes have one more feature to help with basic router security. You can set a
time after which all users in that class are automatically logged out if they have not
typed anything at the keyboard. (By default, a user can remain logged in indefinitely.)
Here, the users in the class we created will be automatically logged out if the keyboard
is idle for five minutes:
[edit system login]
aviva@router1# set class operator-plus-read-config permissions idle-timeout 5
Warning messages are displayed beforehand:
aviva@router1> show system users
9:56PM up 18:48, 2 users, load averages: 0.16, 0.09, 0.04
USER TTY FROM LOGIN@ IDLE WHAT
aviva p0 server.juniper.net 9:42PM 4 cli
aviva@router1> Warning: session will be closed in 1 minute if there is no acti
vity
Warning: session will be closed in 10 seconds if there is no activity
Idle timeout exceeded: closing session
Connection closed by foreign host.
As if all this control weren’t enough, you can also control, down to the specific command
and configuration hierarchy level, what commands users in a particular login
class can and cannot issue and what portions of the configuration they can view and
modify. For example, you can create a class that has the standard operator permissions
but also can issue the request system support command to collect information
to send when reporting a problem with the router:
[edit system login]
aviva@router1# set class operator-plus-support permissions [ clear network reset
trace view ]
aviva@router1# set class operator-plus-support allow-commands "request support
information"
Or you can take the basic operator class and modify it so users can issue all clear
commands except clear system commit (which clears pending configuration commit
operations) and clear system reboot (which clears pending router reboots):
[edit system login]
94 | Chapter 2: Basic Router Security and Access Control
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.