Related Documentation
- EX, J, M, MX, PTX, QFX, T Series
- Specifying Access Privileges for Junos OS Operational Mode Commands
Regular Expressions for Allowing and Denying Junos OS Operational Mode Commands
Use extended regular expressions to specify which operational mode commands are denied or allowed. Table 1 lists common regular expression operators that can be used in the operational mode commands. Command regular expressions implement the extended (modern) regular expressions as defined in POSIX 1003.2.
Table 1: Common Regular Expression Operators to Allow or Deny Operational Mode Commands
Operator | Match |
|---|---|
| | One of two or more terms separated by the pipe (|) symbol. Each term must be a complete standalone expression enclosed in parentheses ( ), with no spaces between the pipe and the adjacent parentheses. For example, (show system alarms)|(show system software). |
^ | At the beginning of an expression, used to denote where the command begins, and where there might be some ambiguity. |
$ | Character at the end of a command. Used to denote a command that must be matched exactly up to that point. For example, allow-commands "show interfaces$" means that the user can issue the show interfaces command but cannot issue the show interfaces detail or show interfaces extensive command. |
[ ] | Range of letters or digits. To separate the start and end of a range, use a hyphen ( - ). |
( ) | A group of commands, indicating a complete, standalone expression to be evaluated; the result is then evaluated as part of the overall expression. Parentheses must always be used in conjunction with pipe operators as explained above. |
If a regular expression contains a syntax error, it becomes invalid, and although the user can log in, the permission granted or denied by the regular expression does not take effect. When regular expressions configured on TACACS+ or RADIUS servers merge with regular expressions configured on the router or switch, if the final expression has a syntax error, the overall result is an invalid regular expression. If a regular expression does not contain any operators, all varieties of the command are allowed. For example, if the following statement is included in the configuration, the user can issue the commands show interfaces detail and show interfaces extensive in addition to showing an individual interface:
Related Documentation
- EX, J, M, MX, PTX, QFX, T Series
- Specifying Access Privileges for Junos OS Operational Mode Commands
Published: 2013-08-15
Related Documentation
- EX, J, M, MX, PTX, QFX, T Series
- Specifying Access Privileges for Junos OS Operational Mode Commands
