On juniper switches is something like root user. Are there any things that must be done from that user? For what root user can be usefull? Or isn't usefull, and can be safetly disabled?
Ryan is correct, you can do absolutely anything from root. JUNOS is built on FreeBSD and inherits that behavior. But to be honest, it's rarely used directly.
The biggest practical example I can think of offhand would be to collect core files from devices without another type of authentication, whether its due to a configuration issue or maybe you have redundant routing engines or a virtual chassis setup. Non-master members don't authenticate with the network, so should you need to get into a member device to collect files, you could use root access in the shell to get those files.
When you first start up any Juniper device, you CANNOT commit your first configuration without root-authentication set, so you are forced to have a root password set. I guess you could think of it as a failsafe, should everything break.
However, you can disable your users from starting a shell with root privileges with login classes.
There are a couple of ways to do it, but one example would be:
set system login class class_name deny-commands "(^start shell$)"
set system login class class_name permissions permission_bits_to_set
If you EXCLUDE "maintenance" as a permission bit, they will not be able to become the superuser (root).
root user for any *nix platform is capable of performing any functions on the system they want - and I mean anything. I'd suggest you look into a wiki article on this as it is a little beyond the scope of this SE.
It is good practice to disable root access to your juniper devices. Most environments disable it in a few different ways.
- blank out the root password
- disable ssh root-login
- disable root-login tampering on user-accounts
There are a couple of things that you may require root access for from time-to-time - an example that comes to mind is that if you attach a USB storage device and need to mount it to copy files off, you will need root privelige to execute the
As others have suggested - the best method of dealing with the root account is the way good SysAdmins would - disable all remote access to root, limit access to shell via RBAC and login roles, and then only when absolutely necessary, use
su from shell to elevate an authorised account.
To complete previous answers, I will point out two practical scenarios where I have to access as root to JunOS recently.
- Collecting log items from multiple members in a Virtual Chassis. You have to access the shell to tar /var/log foldeer.
- Recovering a switch from a zombie status. A couple of EX4200 got stuck in "Loading JunOS" so I have to access the shell for some maintenance process.
As you can see, this is not usual but sometimes you will need this shell access.