Discussion

aviva@router1# set class operator-plus-support permissions [ clear network reset
trace view ]
aviva@router1# set class operator-plus-support deny-commands "clear system"
Parallel statements allow you to fine-tune what portions of the configuration can be
edited or viewed in configuration mode. This is a way to lock portions of the configuration.
The following command does not allow users to modify the protocols portion
of the configuration:
[edit system login]
aviva@router1# set class all-but-protocols permissions [ all ]
aviva@router1# set class all-but-protocols deny-configuration "protocols"
A user in this permission class can edit all portions of the configuration except for
the [edit protocols] section:
[edit]
aviva2@router1# edit protocols
^
syntax error, expecting or .
2.11 Creating a Privilege Class that Hides Encrypted
Passwords
Problem
You need to have all permissions on the router but you don’t want to have all of the
encrypted passwords displayed.
Solution
Create a new class that explicitly includes all the permission bits except for control
and secret:
[edit system login]
aviva@router1# set class power-user permissions [ admin admin-control clear configure
field floppy interface interface-control network reset routing routing-control shell
snmp snmp-control system system-control trace trace-control view maintenance firewall
firewall-control secret-control rollback security security-control access accesscontrol
view-configuration ]
Discussion
Many network operators like to trim shared secrets and other encrypted data out of
their configurations before sharing the configurations with others. The JUNOS software
uses the secret permission bit to control viewing access to the passwords and
the secret-control permission bit to control setting them. This recipe still allows
shared secrets and passwords to be set on the router, but the values are not shown,
copied, or saved (using the configuration mode save command) by the user during
normal operations.
Creating a Privilege Class that Hides Encrypted Passwords | 95
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.