1

On juniper switches is something like root user. Are there any things that must be done from that user? For what root user can be usefull? Or isn't usefull, and can be safetly disabled?

6

Ryan is correct, you can do absolutely anything from root. JUNOS is built on FreeBSD and inherits that behavior. But to be honest, it's rarely used directly.

The biggest practical example I can think of offhand would be to collect core files from devices without another type of authentication, whether its due to a configuration issue or maybe you have redundant routing engines or a virtual chassis setup. Non-master members don't authenticate with the network, so should you need to get into a member device to collect files, you could use root access in the shell to get those files.

When you first start up any Juniper device, you CANNOT commit your first configuration without root-authentication set, so you are forced to have a root password set. I guess you could think of it as a failsafe, should everything break.

However, you can disable your users from starting a shell with root privileges with login classes.

https://www.juniper.net/techpubs/software/junos-es/junos-es93/junos-es-admin-guide/login-classes.html

There are a couple of ways to do it, but one example would be:

set system login class class_name deny-commands "(^start shell$)"

Another:

set system login class class_name permissions permission_bits_to_set

If you EXCLUDE "maintenance" as a permission bit, they will not be able to become the superuser (root).

  • i know what is root :-). But - in linux - there are things that must be done from root(uid==0) and it's impossible or very hard give regular user rights to do them. Question is - if there are things that must be done from root in junos - aftere initial startup. collecting core files is good example - are there other things like it where root user is useful? – undefine Mar 10 '15 at 8:58
  • 1
    In a day to day practical way that would require the user to get into a root shell, not really. A large variety of the JUNOS commands may interact with root level permissions under the hood via the CLI, but the permissions per user stay intact. The root user also manages the kernel and all major processes like RPD (routing protocol daemon). You cannot, completely disable the root user, you just need to disable the ACCESS to it from other users. – Jordan Head Mar 10 '15 at 14:53
2

The root user for any *nix platform is capable of performing any functions on the system they want - and I mean anything. I'd suggest you look into a wiki article on this as it is a little beyond the scope of this SE.

It is good practice to disable root access to your juniper devices. Most environments disable it in a few different ways.

  • blank out the root password
  • disable ssh root-login
  • disable root-login tampering on user-accounts
  • 2
    I think the question is really, "Is there anything that has to be done from root?" – Ron Trunk Mar 9 '15 at 15:57
  • yes. I want to know if there are any disadvantages of disable of root account. Or - there aren't any disadvantages, so disabling is the best solution - and after disabling i'll never have any need of restoring it. – undefine Mar 9 '15 at 18:51
1

There are a couple of things that you may require root access for from time-to-time - an example that comes to mind is that if you attach a USB storage device and need to mount it to copy files off, you will need root privelige to execute the mount_msdosfs command.

As others have suggested - the best method of dealing with the root account is the way good SysAdmins would - disable all remote access to root, limit access to shell via RBAC and login roles, and then only when absolutely necessary, use su from shell to elevate an authorised account.

1

To complete previous answers, I will point out two practical scenarios where I have to access as root to JunOS recently.

  • Collecting log items from multiple members in a Virtual Chassis. You have to access the shell to tar /var/log foldeer.
  • Recovering a switch from a zombie status. A couple of EX4200 got stuck in "Loading JunOS" so I have to access the shell for some maintenance process.

As you can see, this is not usual but sometimes you will need this shell access.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.