According to Juniper documentation, each top-level CLI command and each configuration statement has an access privilege level associated with it. Is there a command which allows one to see the privilege level attached to a command?
The closest thing to what you want would be show cli authorization
. You won't be able to get down to the individual command level unless you specify them yourself with things like allow-commands
, deny-configuration
, etc.
It will show the user logged in, what permissions they have.
Here's an example of a custom login class that has all permissions except for specific types of configuration modes:
jhead@SRX1> show cli authorization
Current user: 'jhead ' class 'CUSTOM'
Permissions:
access -- Can view access configuration
access-control-- Can modify access configuration
admin -- Can view user accounts
admin-control-- Can modify user accounts
clear -- Can clear learned network info
configure -- Can enter configuration mode
control -- Can modify any config
edit -- Can edit full files
field -- Can use field debug commands
firewall -- Can view firewall configuration
firewall-control-- Can modify firewall configuration
floppy -- Can read and write the floppy
interface -- Can view interface configuration
interface-control-- Can modify interface configuration
maintenance -- Can become the super-user
network -- Can access the network
reset -- Can reset/restart interfaces and daemons
rollback -- Can rollback to previous configurations
routing -- Can view routing configuration
routing-control-- Can modify routing configuration
secret -- Can view secret statements
secret-control-- Can modify secret statements
security -- Can view security configuration
security-control-- Can modify security configuration
shell -- Can start a local shell
snmp -- Can view SNMP configuration
snmp-control-- Can modify SNMP configuration
storage -- Can view fibre channel storage protocol configuration
storage-control-- Can modify fibre channel storage protocol configuration
system -- Can view system configuration
system-control-- Can modify system configuration
trace -- Can view trace file settings
trace-control-- Can modify trace file settings
view -- Can view current values and statistics
view-configuration-- Can view all configuration (not including secrets)
all-control -- Can modify any configuration
flow-tap -- Can view flow-tap configuration
flow-tap-control-- Can modify flow-tap configuration
flow-tap-operation-- Can tap flows
idp-profiler-operation-- Can Profiler data
pgcp-session-mirroring-- Can view pgcp session mirroring configuration
pgcp-session-mirroring-control-- Can modify pgcp session mirroring configuration
unified-edge-- Can view unified edge configuration
unified-edge-control-- Can modify unified edge configuration
Individual command authorization:
Allow regular expression: (^configure exclusive$)|(^edit exclusive$)
Deny regular expression: (^configure.*)|(^edit.*)
Allow configuration regular expression: none
Deny configuration regular expression: none
Here is an even more restricted example where individual categories are configured instead of all
:
jhead@SRX1> show cli authorization
Current user: 'jhead ' class 'CUSTOM'
Permissions:
admin -- Can view user accounts
routing -- Can view routing configuration
routing-control-- Can modify routing configuration
system -- Can view system configuration
view -- Can view current values and statistics
Individual command authorization:
Allow regular expression: (^configure exclusive$)|(^edit exclusive$)
Deny regular expression: (^configure.*)|(^edit.*)
Allow configuration regular expression: none
Deny configuration regular expression: none
-
I tried this in a lab environment and most of the permissions simply permit to view or modify certain part of the configuration. As much as I tested, then only following permissions are directly related to some operational mode command group:
field
,view
(show
commands),reset
(restart <SERVICE_NAME>
commands),network
(ping
,telnet
,ssh
etc),shell
(start shell <SHELL>
command) andclear
(clear
commands). – Martin May 15 '20 at 23:05
It's in the table you've linked to: read-only can only view, operator can additionally run clear
, network
, reset
, trace
, and view
and superuser can do everything.
If you create your own class the permission bit table below shows all the privileges you can assign to it.
-
I meant the association between the commands and permission bits. For example, which permissions requires a
file copy /var/tmp/file.txt re1:/var/tmp/
command? Ormonitor interface em0
command. I guess one way to solve this would be an additionaldisplay
option, e.gmonitor interface em0 | display required-permission
– Martin May 14 '20 at 13:00