close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Introduction
- play_arrow Overview
- play_arrow Access and Manage Paragon Automation Account
play_arrow Administration
- play_arrow Introduction
  - Administration Overview
  - Administration Workflow
- play_arrow Organization Management
- play_arrow Site Management
- play_arrow User Management
- play_arrow Inventory Management
  - About the Inventory Page
  - Assign a Device to a Site
- play_arrow Audit Logs
  - Audit Logs Overview
  - About the Audit Logs Page
play_arrow Device Life Cycle Management
- play_arrow Introduction
- play_arrow Day-Wise Activities for Device Life Cycle Management
- play_arrow Field Technician User Interface
  - Field Technician UI Overview
  - Working with Field Technician UI Pages
- play_arrow Onboarding Profiles
- play_arrow Plan Device Onboarding
- play_arrow View Device Onboarding
- play_arrow Device Management
play_arrow Observability
- play_arrow Introduction
  - Observability Overview
- play_arrow Troubleshoot Devices
- play_arrow View Network Topology
play_arrow Trust and Compliance
- play_arrow Introduction
  - Trust and Compliance Overview
  - Perform Compliance Scan and Manage Checklists
- play_arrow Manage Trust Settings and Trust Scores
- play_arrow Manage Compliance Scans
- play_arrow Manage Vulnerabilities
- play_arrow Monitor Integrity
play_arrow Service Orchestration
- play_arrow Introduction
  - Service Orchestration Overview
  - L3VPN Service Provisioning Workflow
- play_arrow View Service Design Catalog
  - Service Design Overview
  - About the Service Designs Page
- play_arrow Manage Customers
- play_arrow Add Resources for Network Services
  - Add Network Resources for L3VPN Service
- play_arrow Manage Service Instances
- play_arrow Provision L3VPN Service
- play_arrow Monitor Service Order Execution Workflows
play_arrow Active Assurance
- play_arrow Introduction
- play_arrow Test Agents
- play_arrow Tests and Monitors
play_arrow Paragon Shell CLI Reference

list Table of Contents

English

Manage Paragon Shell Users

date_range 18-Jun-24

arrow_backward

arrow_forward

System administrators (root user) use Paragon Shell to add users so that these users can access and manage Paragon Automation cluster configurations. The users created in Paragon Shell and Paragon Automation Web GUI are not shared across the two user interfaces.

The following sections describe the user management tasks you can perform by using Paragon Shell.

Note:

User information configured on one node is deployed across all the nodes in the Paragon Automation cluster.

Create a User

System administrators and superusers can use Paragon Shell to create users who can access and manage the Paragon Automation cluster based on the privileges defined by the role assigned to them.

To create a user:

SSH to a node in the Paragon Automation cluster.
Log in to Paragon Shell.
If you are a system administrator, log in as the root user. If you are a superuser, log in with your login credentials shared by the system administrator.

You are placed in the operational mode of Paragon Shell.

Enter the configuration mode.

content_copy zoom_out_map
root@eop-primary> configure
Entering configuration mode

[edit]

Configure the username, access privileges, and authentication method to authenticate the user.
```
root@eop-primary# set system login user username class class authentication authentication-method
```
Where,
- username is the unique name that identifies the user.
- class is the access privilege assigned to the user. The options are:
  - read-only—User can access Paragon Shell and view details about the Paragon Automation cluster but cannot enter configuration mode to modify cluster configuration.
  - super-user—User can access Paragon Shell and enter configuration mode to modify cluster configuration.
- authentication is the possible authentication methods that can be used to authenticate users. The options are:
  - plain-text-password—Enter the password in plain text. The password can contain alphanumeric and special characters and must have a minimum of six characters. The password is stored in an encrypted format in the configuration file.
  - encrypted-password—Enter the encrypted password and enclose it in quotation marks. Currently, the supported encryption algorithm is SHA-512.
  - ssh-algorithm—Generate an SSH key pair and use the key to authenticate users. The three types of SSH key algorithms that can be used are:
    - ssh-ecdsa
    - ssh-ed25519
    - ssh-rsa
Note:
You can use both password and SSH keys to authenticate users.

You can configure more than one SSH key to authenticate users.

Commit the changes and exit the configuration mode.

content_copy zoom_out_map
root@eop-primary# commit and-quit
warning: *** operating on 176.16.10.4 ***
warning: *** operation on 176.16.10.4 succeeds ***
warning: *** operating on 176.16.10.3 ***
warning: *** operation on 176.16.10.3 succeeds ***
warning: *** operating on 176.16.10.2 ***
warning: *** operation on 176.16.10.2 succeeds ***
commit complete
Exiting configuration mode

The user is successfully created.

Deploy the configuration on all the nodes in the cluster.

content_copy zoom_out_map
root@eop-primary> request paragon deploy user
Getting user-config configmap...
Added user: ['username']
Modified user: []
Deleted user: []
warning: *** operating on 176.16.10.4 ***
warning: *** operation on 176.16.10.4 succeeds ***
warning: *** operating on 176.16.10.3 ***
warning: *** operation on 176.16.10.3 succeeds ***
warning: *** operating on 176.16.10.2 ***
warning: *** operation on 176.16.10.2 succeeds ***
warning: *** operating on 176.16.10.1 ***
warning: *** operation on 176.16.10.1 succeeds ***
Deleting user-config configmap...
Creating new user-config configmap...

The configuration is deployed on all the nodes in the Paragon Automation cluster.

The system administrator must manually share the IP addresses and log in credentials with the user and the user can log in to Paragon Shell to view and manage the Paragon Automation cluster based on the access privileges assigned to them.

(Optional) Confirm the user details.

content_copy zoom_out_map
root@eop-primary> configure
Entering configuration mode

[edit]
root@eop-primary# show system login

For every user created by using Paragon Shell, a Linux user with identical username, access privileges, and authentication method is created on every single node in the Paragon Automation cluster.

Note:

When a commit is initiated from one node (node A), commit is first attempted on the rest of the nodes (node B, C, D) before it is attempted on the node on which the commit was initiated (node A). In case the commit fails on any of the nodes, the changes committed is rolled back on the nodes on which commit succeeded.
Commit fails when multiple users make changes to the cluster configuration at the same time from different nodes. In such scenarios, we need to rollback all the committed changes on the other nodes and only commit changes from a single node to ensure that all the nodes in the cluster have the same configuration.

Modify User Information

System administrators and superuser can modify the access privileges of users and the authentication method used to authenticate the user.

To modify user details:

SSH to a node in the Paragon Automation cluster.
Log in to Paragon Shell.
If you are a system administrator, log in as the root user. If you are a superuser, log in with your login credentials shared by the system administrator.

You are placed in the operational mode.

Enter the configuration mode.

content_copy zoom_out_map
root@eop-primary> configure
Entering configuration mode

[edit]

Modify the access privilege for the user and the authentication method used to authenticate the user, as needed.
```
root@eop-primary# set system login user username authentication authentication-method
```

Commit the changes and exit the configuration mode.

content_copy zoom_out_map
root@eop-primary# commit and-quit
warning: *** operating on 176.16.10.4 ***
warning: *** operation on 176.16.10.4 succeeds ***
warning: *** operating on 176.16.10.3 ***
warning: *** operation on 176.16.10.3 succeeds ***
warning: *** operating on 176.16.10.2 ***
warning: *** operation on 176.16.10.2 succeeds ***
commit complete
Exiting configuration mode

The user is successfully created.

Deploy the configuration on all the nodes in the cluster.

content_copy zoom_out_map
root@eop-primary> request paragon deploy user
Getting user-config configmap...
Added user: []
Modified user: ['username']
Deleted user: []
warning: *** operating on 176.16.10.4 ***
warning: *** operation on 176.16.10.4 succeeds ***
warning: *** operating on 176.16.10.3 ***
warning: *** operation on 176.16.10.3 succeeds ***
warning: *** operating on 176.16.10.2 ***
warning: *** operation on 176.16.10.2 succeeds ***
warning: *** operating on 176.16.10.1 ***
warning: *** operation on 176.16.10.1 succeeds ***
Deleting user-config configmap...
Creating new user-config configmap...

The username of the user whose user details are modified is displayed. The configuration is deployed on all the nodes in the Paragon Automation cluster.

Delete a User

To delete a user:

SSH to a node in the Paragon Automation cluster.
Log in to Paragon Shell.
If you are a system administrator, log in as the root user. If you are a superuser, log in with your login credentials shared by the system administrator.

You are placed in the operational mode.

Enter the configuration mode.

content_copy zoom_out_map
root@eop-primary> configure
Entering configuration mode

[edit]

To delete the user.

content_copy zoom_out_map
root@eop-primary# delete system login user username

Commit the changes and exit the configuration mode.

content_copy zoom_out_map
root@eop-primary# commit and-quit
warning: *** operating on 176.16.10.4 ***
warning: *** operation on 176.16.10.4 succeeds ***
warning: *** operating on 176.16.10.3 ***
warning: *** operation on 176.16.10.3 succeeds ***
warning: *** operating on 176.16.10.2 ***
warning: *** operation on 176.16.10.2 succeeds ***
commit complete
Exiting configuration mode

The user's access to Paragon Automation cluster is revoked.

Deploy the configuration on all the nodes in the cluster.

content_copy zoom_out_map
root@eop-primary> request paragon deploy user
Getting user-config configmap...
Added user: []
Modified user: []
Deleted user: ['username']
warning: *** operating on 176.16.10.4 ***
warning: *** operation on 176.16.10.4 succeeds ***
warning: *** operating on 176.16.10.3 ***
warning: *** operation on 176.16.10.3 succeeds ***
warning: *** operating on 176.16.10.2 ***
warning: *** operation on 176.16.10.2 succeeds ***
warning: *** operating on 176.16.10.1 ***
warning: *** operation on 176.16.10.1 succeeds ***
Deleting user-config configmap...
Creating new user-config configmap...

The user's access to Paragon Shell is removed. The configuration is deployed on all the nodes in the Paragon Automation cluster.

(Optional) Confirm that the user is logged out of the Paragon Automation cluster.
```
root@eop-primary> configure
Entering configuration mode

[edit]
root@eop-primary# show system login
```

Logging in to Paragon Shell as a New User

The system administrator manually shares the IP address and credentials (username and password) with the users to access Paragon Shell.

To log in to Paragon Shell as a new user:

SSH to a node in the Paragon Automation cluster.
Enter your username and password.
Based on your login class you are either placed in Paragon Shell or the Linux user shell.
The two login classes are:
- super-user—You are placed in the Paragon Shell.
- read-only—You are placed in the Linux user shell initially and prompted to re-enter your password. Re-enter your password to log in to Paragon Shell.
You are logged in to Paragon Shell.

Depending on your access privileges, you can view and manage Paragon Automation cluster configuration.

Retrieve User Information On a Recovered Node in the Paragon Automation Cluster

When a node is repaired and recovered in the Paragon Automation cluster the user configuration on the node is lost. Users will not be able to use their user credentials to log in to the node and access the Linux user shell and Paragon Shell.

Note:

Before you retrieve user configuration on the recovered node, ensure that there are no pending commits in any of the nodes in the Paragon Automation cluster, including in the recovered node.

To retrieve user configuration on the recovered node:

SSH to a node with the latest user configuration in the Paragon Automation cluster.
You are logged into Paragon Shell.

Enter the configuration mode.

content_copy zoom_out_map
root@eop-primary> configure
Entering configuration mode

[edit]

Execute the commit command to retrieve the latest cluster configuration.
```
[edit]
root@eop-primary# commit and-quit
commit complete
Exiting configuration mode
```
The user configuration is updated on all the nodes.

Deploy the user configuration file on all the nodes in the cluster.

content_copy zoom_out_map
root@eop-primary> request paragon deploy user recover true
Getting user-config configmap...
Added user: ['username']
Modified user: []
Deleted user: []
warning: *** operating on 176.16.10.4 ***
warning: *** operation on 176.16.10.4 succeeds ***
warning: *** operating on 176.16.10.3 ***
warning: *** operation on 176.16.10.3 succeeds ***
warning: *** operating on 176.16.10.2 ***
warning: *** operation on 176.16.10.2 succeeds ***
warning: *** operating on 176.16.10.1 ***
warning: *** operation on 176.16.10.1 succeeds ***
Deleting user-config configmap...
Creating new user-config configmap...

Users can now log in to the node using their existing Paragon Shell credentials. The access privileges and authentication method also remains the same.

arrow_backward PREVIOUS Manage Users and Invites

NEXT arrow_forward Manage Your Paragon Automation Account

Juniper Paragon Automation User Guide

ON THIS PAGE

Manage Paragon Shell Users

Create a User

Modify User Information

Delete a User

Logging in to Paragon Shell as a New User

Retrieve User Information On a Recovered Node in the Paragon Automation Cluster

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry