User Authentication Overview

This section contains the following topics:

• User Authentication
• User Accounts
• Login Classes
• Template Accounts

User Authentication

JUNOS Software supports three methods of user authentication: local password authentication, Remote Authentication Dial-In User Service (RADIUS), and Terminal Access Controller Access Control System Plus (TACACS+).

With local password authentication, you configure a password for each user allowed to log into the

RADIUS and TACACS+ are authentication methods for validating users who attempt to access the device using Telnet. Both are distributed client/server systems—the RADIUS and TACACS+ clients run on the device, and the server runs on a remote network system.

You can configure the device to use RADIUS or TACACS+ authentication, or both, to validate users who attempt to access the device. If you set up both authentication methods, you also can configure which the device will try first.

User Accounts

User accounts provide one way for users to access the services router. Users can access the device without accounts if you configured RADIUS or TACACS+ servers, as described in Managing User Authentication and Managing User Authentication with a Configuration Editor. After you have created an account, the device creates a home directory for the user. An account for the user root is always present in the configuration. For information about configuring the password for the user root, see the JUNOS Software Administration Guide. For each user account, you can define the following:

• Username—Name that identifies the user. It must be unique within the device. Do not include spaces, colons, or commas in the username.
• User's full name—If the full name contains spaces, enclose it in quotation marks (“ ”). Do not include colons or commas.
• User identifier (UID)—Numeric identifier that is associated with the user account name. The identifier must be in the range 100 through 64000 and must be unique within the device. If you do not assign a UID to a username, the software assigns one when you commit the configuration, preferring the lowest available number.
• User's access privilege—You can create login classes with specific permission bits or use one of the default classes listed in Table 10.
• Authentication method or methods and passwords that the user can use to access the device—You can use SSH or an MD5 password, or you can enter a plain-text password that JUNOS Software encrypts using MD5-style encryption before entering it in the password database. If you configure the plain-text-password option, you are prompted to enter and confirm the password.

Login Classes

All users who log into the services router must be in a login class. You can define any number of login classes. You then apply one login class to an individual user account. With login classes, you define the following:

• Access privileges users have when they are logged into the device. For more information, see Permission Bits.
• Commands and statements that users can and cannot specify. For more information, see Denying or Allowing Individual Commands.
• How long a login session can be idle before it times out and the user is logged off.

The software contains a few predefined login classes, which are listed in Table 10. The predefined login classes cannot be modified.

Table 10: Predefined Login Classes

Permission Bits

Each top-level command-line interface (CLI) command and each configuration statement has an access privilege level associated with it. Users can execute only those commands and configure and view only those statements for which they have access privileges. The access privileges for each login class are defined by one or more permission bits (see Table 11).

Two forms for the permissions control the individual parts of the configuration:

• "Plain" form—Provides read-only capability for that permission type. An example is interface.
• Form that ends in -control—Provides read and write capability for that permission type. An example is interface-control.

Table 11: Permission Bits for Login Classes

Denying or Allowing Individual Commands

By default, all top-level CLI commands have associated access privilege levels. Users can execute only those commands and view only those statements for which they have access privileges. For each login class, you can explicitly deny or allow the use of operational and configuration mode commands that are otherwise permitted or not allowed by a permission bit.

Template Accounts

You use local user template accounts when you need different types of templates. Each template can define a different set of permissions appropriate for the group of users who use that template. These templates are defined locally on the services router and referenced by the TACACS+ and RADIUS authentication servers.

When you configure local user templates and a user logs in, JUNOS Software issues a request to the authentication server to authenticate the user's login name. If a user is authenticated, the server returns the local username to the device, which then determines whether a local username is specified for that login name (local-username for TACACS+, Juniper-Local-User for RADIUS). If so, the device selects the appropriate local user template locally configured on the device. If a local user template does not exist for the authenticated user, the device defaults to the remote template.

For more information, see Setting Up Template Accounts.