According to Juniper documentation, each top-level CLI command and each configuration statement has an access privilege level associated with it. Is there a command which allows one to see the privilege level attached to a command?
The closest thing to what you want would be
show cli authorization. You won't be able to get down to the individual command level unless you specify them yourself with things like
It will show the user logged in, what permissions they have.
Here's an example of a custom login class that has all permissions except for specific types of configuration modes:
jhead@SRX1> show cli authorization Current user: 'jhead ' class 'CUSTOM' Permissions: access -- Can view access configuration access-control-- Can modify access configuration admin -- Can view user accounts admin-control-- Can modify user accounts clear -- Can clear learned network info configure -- Can enter configuration mode control -- Can modify any config edit -- Can edit full files field -- Can use field debug commands firewall -- Can view firewall configuration firewall-control-- Can modify firewall configuration floppy -- Can read and write the floppy interface -- Can view interface configuration interface-control-- Can modify interface configuration maintenance -- Can become the super-user network -- Can access the network reset -- Can reset/restart interfaces and daemons rollback -- Can rollback to previous configurations routing -- Can view routing configuration routing-control-- Can modify routing configuration secret -- Can view secret statements secret-control-- Can modify secret statements security -- Can view security configuration security-control-- Can modify security configuration shell -- Can start a local shell snmp -- Can view SNMP configuration snmp-control-- Can modify SNMP configuration storage -- Can view fibre channel storage protocol configuration storage-control-- Can modify fibre channel storage protocol configuration system -- Can view system configuration system-control-- Can modify system configuration trace -- Can view trace file settings trace-control-- Can modify trace file settings view -- Can view current values and statistics view-configuration-- Can view all configuration (not including secrets) all-control -- Can modify any configuration flow-tap -- Can view flow-tap configuration flow-tap-control-- Can modify flow-tap configuration flow-tap-operation-- Can tap flows idp-profiler-operation-- Can Profiler data pgcp-session-mirroring-- Can view pgcp session mirroring configuration pgcp-session-mirroring-control-- Can modify pgcp session mirroring configuration unified-edge-- Can view unified edge configuration unified-edge-control-- Can modify unified edge configuration Individual command authorization: Allow regular expression: (^configure exclusive$)|(^edit exclusive$) Deny regular expression: (^configure.*)|(^edit.*) Allow configuration regular expression: none Deny configuration regular expression: none
Here is an even more restricted example where individual categories are configured instead of
jhead@SRX1> show cli authorization Current user: 'jhead ' class 'CUSTOM' Permissions: admin -- Can view user accounts routing -- Can view routing configuration routing-control-- Can modify routing configuration system -- Can view system configuration view -- Can view current values and statistics Individual command authorization: Allow regular expression: (^configure exclusive$)|(^edit exclusive$) Deny regular expression: (^configure.*)|(^edit.*) Allow configuration regular expression: none Deny configuration regular expression: none