Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

header-navigation
keyboard_arrow_up
close
keyboard_arrow_left
Automation Scripting User Guide
Table of Contents Expand all
list Table of Contents
file_download PDF
{ "lLangCode": "en", "lName": "English", "lCountryCode": "us", "transcode": "en_US" }
English
keyboard_arrow_right

Configure Checksum Hashes for a Commit Script

date_range 29-Nov-23

You can configure one or more checksum hashes that can be used to verify the integrity of a commit script before the script runs on the switch, router, or security device.

To configure a checksum hash:

  1. Create the script.
  2. Place the script in the /var/db/scripts/commit directory on the device.
  3. Run the script through one or more hash functions to calculate hash values.

    Starting in Junos OS Release 18.2R2 and 18.3R1, Junos OS supports only the SHA-256 hash function for configuring script checksum hashes. Earlier releases support the MD5, SHA-1, and SHA-256 hash functions.

    content_copy zoom_out_map
    user@host> file checksum md5 /var/db/scripts/commit/script1.slax
    MD5 (/var/db/scripts/commit/script1.slax) = 3af7884eb56e2d4489c2e49b26a39a97
    content_copy zoom_out_map
    user@host> file checksum sha1 /var/db/scripts/commit/script1.slax
    SHA1 (/var/db/scripts/commit/script1.slax) = 00dc690fb08fb049577d012486c9a6dad34212c0
    content_copy zoom_out_map
    user@host> file checksum sha-256 /var/db/scripts/commit/script1.slax
    SHA256 (/var/db/scripts/commit/script1.slax) = 150bf53383769f3bfedd41fe73320777f208d4fda81230cb27b8738
  4. Configure the script and the checksum statement for one or more hash values.
    content_copy zoom_out_map
    [edit system scripts commit]
    user@host# set file script1.slax checksum md5 3af7884eb56e2d4489c2e49b26a39a97
    
    content_copy zoom_out_map
    [edit system scripts commit]
    user@host# set file script1.slax checksum sha-1 00dc690fb08fb049577d012486c9a6dad34212c0
    
    content_copy zoom_out_map
    [edit system scripts commit]
    user@host# set file script1.slax checksum sha-256 150bf53383769f3bfedd41fe73320777f208d4fda81230cb27b8738
    

    During the execution of the script, Junos OS recalculates the checksum value using the configured hash algorithm and verifies that the calculated value matches the configured value. If the values differ, the execution of the script fails. When you configure multiple checksum values with different hash algorithms, all the configured values must match the calculated values; otherwise, the script execution fails. The commit operation also fails.

Change History Table

Feature support is determined by the platform and release you are using. Use Feature Explorer to determine if a feature is supported on your platform.

Release
Description
18.3R1
Starting in Junos OS Release 18.2R2 and 18.3R1, Junos OS supports only the SHA-256 hash function for configuring script checksum hashes.
footer-navigation