3

According to Juniper documentation, each top-level CLI command and each configuration statement has an access privilege level associated with it. Is there a command which allows one to see the privilege level attached to a command?

Improve this question
1

The closest thing to what you want would be show cli authorization. You won't be able to get down to the individual command level unless you specify them yourself with things like allow-commands, deny-configuration, etc.

It will show the user logged in, what permissions they have.

Here's an example of a custom login class that has all permissions except for specific types of configuration modes:

jhead@SRX1> show cli authorization
Current user: 'jhead       ' class 'CUSTOM'
Permissions:
    access      -- Can view access configuration
    access-control-- Can modify access configuration
    admin       -- Can view user accounts
    admin-control-- Can modify user accounts
    clear       -- Can clear learned network info
    configure   -- Can enter configuration mode
    control     -- Can modify any config
    edit        -- Can edit full files
    field       -- Can use field debug commands
    firewall    -- Can view firewall configuration
    firewall-control-- Can modify firewall configuration
    floppy      -- Can read and write the floppy
    interface   -- Can view interface configuration
    interface-control-- Can modify interface configuration
    maintenance -- Can become the super-user
    network     -- Can access the network
    reset       -- Can reset/restart interfaces and daemons
    rollback    -- Can rollback to previous configurations
    routing     -- Can view routing configuration
    routing-control-- Can modify routing configuration
    secret      -- Can view secret statements
    secret-control-- Can modify secret statements
    security    -- Can view security configuration
    security-control-- Can modify security configuration
    shell       -- Can start a local shell
    snmp        -- Can view SNMP configuration
    snmp-control-- Can modify SNMP configuration
    storage     -- Can view fibre channel storage protocol configuration
    storage-control-- Can modify fibre channel storage protocol configuration
    system      -- Can view system configuration
    system-control-- Can modify system configuration
    trace       -- Can view trace file settings
    trace-control-- Can modify trace file settings
    view        -- Can view current values and statistics
    view-configuration-- Can view all configuration (not including secrets)
    all-control -- Can modify any configuration
    flow-tap    -- Can view flow-tap configuration
    flow-tap-control-- Can modify flow-tap configuration
    flow-tap-operation-- Can tap flows
    idp-profiler-operation-- Can Profiler data
    pgcp-session-mirroring-- Can view pgcp session mirroring configuration
    pgcp-session-mirroring-control-- Can modify pgcp session mirroring configuration
    unified-edge-- Can view unified edge configuration
    unified-edge-control-- Can modify unified edge configuration
Individual command authorization:
    Allow regular expression: (^configure exclusive$)|(^edit exclusive$)
    Deny regular expression: (^configure.*)|(^edit.*)
    Allow configuration regular expression: none
    Deny configuration regular expression: none

Here is an even more restricted example where individual categories are configured instead of all:

jhead@SRX1> show cli authorization
Current user: 'jhead       ' class 'CUSTOM'
Permissions:
    admin       -- Can view user accounts
    routing     -- Can view routing configuration
    routing-control-- Can modify routing configuration
    system      -- Can view system configuration
    view        -- Can view current values and statistics
Individual command authorization:
    Allow regular expression: (^configure exclusive$)|(^edit exclusive$)
    Deny regular expression: (^configure.*)|(^edit.*)
    Allow configuration regular expression: none
    Deny configuration regular expression: none
Improve this answer
  • I tried this in a lab environment and most of the permissions simply permit to view or modify certain part of the configuration. As much as I tested, then only following permissions are directly related to some operational mode command group: field, view(show commands), reset(restart <SERVICE_NAME> commands), network(ping, telnet, ssh etc), shell(start shell <SHELL> command) and clear(clear commands). – Martin May 15 '20 at 23:05
0

It's in the table you've linked to: read-only can only view, operator can additionally run clear, network, reset, trace, and view and superuser can do everything.

If you create your own class the permission bit table below shows all the privileges you can assign to it.

Improve this answer
  • I meant the association between the commands and permission bits. For example, which permissions requires a file copy /var/tmp/file.txt re1:/var/tmp/ command? Or monitor interface em0 command. I guess one way to solve this would be an additional display option, e.g monitor interface em0 | display required-permission – Martin May 14 '20 at 13:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.