Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

header-navigation
keyboard_arrow_up
close
keyboard_arrow_left
Automation Scripting User Guide
Table of Contents Expand all
list Table of Contents
file_download PDF
{ "lLangCode": "en", "lName": "English", "lCountryCode": "us", "transcode": "en_US" }
English
keyboard_arrow_right

Execute an Op Script from a Remote Site

date_range 29-Nov-23

As an alternative to storing operation (op) scripts locally on the device, you can store op scripts at a remote site. You then execute a remote op script by issuing the op command and specifying the url url option. You can execute SLAX and XSLT op scripts from a remote site by default. To execute Python op scripts from a remote site, you must first configure the allow-url-for-python statement at the [edit system scripts op] hierarchy level. Because you cannot guarantee that scripts executed from remote sites are secure, we recommend that you only authorize trusted users to execute scripts using the op url command.

Note:

Statements configured under the [edit system scripts op] hierarchy level are only enforced for op scripts that are local to the device. Thus, even if you configure memory allocation, script dampening, script start options, traceoptions, or other op script-specific statements within that hierarchy, the device does not apply the configuration when you execute a remote script using the op url command.

To execute an op script from a remote site:

  1. Create the script.
  2. (Optional) Store the script temporarily in the /var/tmp directory on the device, and run the script through one or more hash functions to calculate hash values.

    Starting in Junos OS Release 18.2R2 and 18.3R1, Junos OS supports only the SHA-256 hash function for script checksum hashes. Earlier releases support the MD5, SHA-1, and SHA-256 hash functions.

    content_copy zoom_out_map
    user@host> file checksum md5 /var/tmp/script1.slax
    MD5 (/var/tmp/script1.slax) = 3af7884eb56e2d4489c2e49b26a39a97
    content_copy zoom_out_map
    user@host> file checksum sha1 /var/tmp/script1.slax
    SHA1 (/var/tmp/script1.slax) = 00dc690fb08fb049577d012486c9a6dad34212c0
    content_copy zoom_out_map
    user@host> file checksum sha-256 /var/tmp/script1.slax
    SHA256 (/var/tmp/script1.slax) = 150bf53383769f3bfedd41fe73320777f208d4fda81230cb27b8738
  3. For Python scripts, configure the allow-url-for-python statement and the language python or language python3 statement.
    content_copy zoom_out_map
    [edit]
    user@host# set system scripts op allow-url-for-python
    user@host# set system scripts language (python | python3)
    user@host# commit
    
  4. Place the script on the remote server.
  5. Provide the script URL and the optional hash values to the administrators who will execute the script.
  6. Execute the script by running the op url command and specifying the URL that points to the remote file.
    content_copy zoom_out_map
    user@host> op url https://www.juniper.net/scripts/script1.slax 
    key sha-256 150bf53383769f3bfedd41fe73320777f208d4fda81230cb27b8738
    

    This example shows how to include the key option and the SHA-256 checksum information.

If you instead want to prevent the execution of any op scripts from remote sites, configure the no-allow-url statement at the [edit system scripts op] hierarchy level.

content_copy zoom_out_map
user@host# set system scripts op no-allow-url
user@host# commit

When you configure the no-allow-url statement, issuing the op url url operational mode command generates an error. This statement takes precedence when the allow-url-for-python statement is also present in the configuration.

Change History Table

Feature support is determined by the platform and release you are using. Use Feature Explorer to determine if a feature is supported on your platform.

Release
Description
18.3R1
Starting in Junos OS Release 18.2R2 and 18.3R1, Junos OS supports only the SHA-256 hash function for script checksum hashes.
footer-navigation