close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Login Classes and Login Settings
- Login Classes Overview
- Login Settings
play_arrow User Accounts
play_arrow Passwords for User Access
play_arrow User Authentication
play_arrow Remote Access Management
- Remote Access Overview
- Configuration Guidelines for Securing Console Port Access
play_arrow Device Discovery
- Device Discovery Using LLDP
play_arrow Configuration Statements and Operational Commands
- Junos CLI Reference Overview

list Table of Contents

English

Login Settings

date_range 30-Nov-23

arrow_backward

arrow_forward

Junos OS Evolved enables you to define various settings for users when they log in to a device. You (the system administrator) can configure:

Messages or announcements to display before or after login
Whether to display system alarms upon login
Login tips
Timeout values for idle sessions
Whether to lock a user account after a number of failed authentication attempts

Display a System Login Announcement or Message

Sometimes you want to make announcements only to authorized users after they log in to a device. For example, you might want to announce an upcoming maintenance event. At other times, it might be appropriate to display a message, such as a security warning, to any user that connects to the device.

By default, Junos OS Evolved does not display any login message or announcement. You can configure the device to display a login message or announcement by including the message statement or the announcement statement at the [edit system login] hierarchy level. Whereas the device displays a login message after a user connects to the device but before the user logs in, it displays an announcement only after the user successfully logs in to the device.

You can format the message or announcement text using the following special characters. If the text contains spaces, enclose it in quotation marks:

\n—New line
\t—Horizontal tab
\'—Single quotation mark
\"—Double quotation mark
\\—Backslash

To configure an announcement that only authorized users can see and a message that any user can see:

Include the announcement statement and the message statement at the

[edit system
                        login]

hierarchy level.

content_copy zoom_out_map
[edit system login]
user@host# set announcement text
user@host# set message text

For example:

content_copy zoom_out_map
system {
    login {
        announcement  "\tJuly 27th 1:00 AM to 8:00\n\nPlanned Network Maintenance\n\nAFFECTED  LOCATIONS:  Sunnyvale\n\nPLANNED ACTIVITY: Upgrade all 6200 switch firmware to the Enterprise TAC recommended firmware version\n\nPURPOSE: This activity will help to minimize the impact of unplanned power outages as well as address known issues within our currently installed firmware version(s)\n\nWHAT TO EXPECT: During the maintenance window for your site, the office network will not be available.\n\n"; 
        message "\n\tAcme Router Lab\n\n\tUNAUTHORIZED USE OF THIS ROUTER\n\tIS STRICTLY PROHIBITED!\n\n\tPlease contact \'jsmith@example.com\' to gain\n\taccess to this equipment if you need authorization.\n\n"
    }
}

Commit the configuration.
```
[edit system login]
user@host# commit
```

Connect to the device to verify the presence of the new message.

The preceding configuration example displays the following login message after the user connects to the device. The example displays the announcement after the user logs in:

content_copy zoom_out_map
server% ssh host

        Acme Router Lab

        UNAUTHORIZED USE OF THIS ROUTER
        IS STRICTLY PROHIBITED!

        Please contact 'jsmith@example.com' to gain
        access to this equipment if you need authorization.

Password:

        July 27th 1:00 AM to 8:00

Planned Network Maintenance

AFFECTED  LOCATIONS:  Sunnyvale

PLANNED ACTIVITY: Upgrade all 6200 switch firmware to the Enterprise TAC recommended firmware version

PURPOSE: This activity will help to minimize the impact of unplanned power outages as well as address known issues within our currently installed firmware version(s)

WHAT TO EXPECT: During the maintenance window for your site, the office network will not be available.

Display System Alarms Upon Login

You can configure Juniper Networks devices to execute the show system alarms command whenever a user in a given login class logs in to the device.

To display alarms whenever a user in a specific login class logs in to the device:

Configure the login-alarms statement for the appropriate login class.
```
[edit system login class class-name]
user@host# set login-alarms
```
For example, to display alarms whenever a user in the admin login class logs in to the device:
```
[edit system login class admin]
user@host# set login-alarms
```

Commit the configuration.

content_copy zoom_out_map
[edit system login class class-name]
user@host# commit

When a user in the given login class logs in to the device, the device displays the current alarms.

content_copy zoom_out_map
$ ssh user@host.example.com
Password:
--- JUNOS 21.1R2.6-EVO Linux (none) 4.8.28-WR2.2.1_standard-g3999f55 #1 SMP PREEMPT Fri Jun 4 00:19:58 PDT 2021 x86_64 x86_64 x86_64 GNU/Linux

2 alarms currently active
Alarm time               Class  Description
2021-07-22 15:00:14 PDT  Minor  port-1/0/0: Optics does not support configured speed
2021-07-22 15:00:14 PDT  Minor  port-1/0/1: Optics does not support configured speed

Configure Login Tips

Configure the login-tip statement at the [edit system login class class-name] hierarchy level.
```
[edit system login class class-name]
user@host# set login-tip
```

Commit the configuration.

content_copy zoom_out_map
[edit system login class class-name]
user@host# commit

When you configure the login-tip statement, the device displays a tip to any user in the specified class who logs in to the device.

content_copy zoom_out_map
$ ssh user@host.example.com
Password:

JUNOS tip:
In configuration mode, the [edit] banner displays the current location
in the configuration hierarchy.

user@host>

Configure the Timeout Value for Idle Login Sessions

An idle login session is one in which the CLI displays the operational mode or configuration mode prompt but there is no input from the keyboard. By default, a login session remains established until a user logs out of the device, even if that session is idle. To close idle sessions automatically, you must configure a time limit for each login class. If a session established by a user in that class remains idle for the configured time limit, the session automatically closes. Automatically closing idle login sessions helps to prevent malicious users from gaining access to the device and performing operations with an authorized user account.

You can configure an idle timeout only for user-defined classes. You cannot configure this option for the system predefined classes: operator, read-only, super-user or superuser, and unauthorized.

To define the timeout value for idle login sessions:

Specify the number of minutes that a session can be idle before the system automatically closes the session.
```
[edit system login class class-name]
user@host# set idle-timeout minutes 
```
For example, to automatically disconnect idle sessions of users in the admin class after fifteen minutes:
```
[edit system login class admin]
user@host# set idle-timeout 15
```

Commit the configuration.

content_copy zoom_out_map
[edit system login class class-name]
user@host# commit

If you configure a timeout value, the CLI displays messages similar to the following when timing out an idle user. The CLI starts displaying these messages 5 minutes before disconnecting the user.

content_copy zoom_out_map
user@host> Session will be closed in 5 minutes if there is no activity.
Warning: session will be closed in 1 minute if there is no activity
Warning: session will be closed in 10 seconds if there is no activity
Idle timeout exceeded: closing session

If you configure a timeout value, the session closes after the specified time elapses, except in the following cases:

The user is running the ssh or telnet command.
The user is logged into the local UNIX shell.
The user is monitoring interfaces using the monitor interface or the monitor traffic command.

Login Retry Options

You can configure login retry options on Juniper Network devices to protect the devices from malicious users. You can configure the following options:

The number of times a user can enter invalid login credentials before the system closes the connection.
Whether and for how long to lock a user account after the user reaches the threshold of failed authentication attempts.

Limiting the login attempts and locking the user account help to protect the device from malicious users attempting to access the system by guessing the password of an authorized user account. You can unlock the user account or define a time period for the user account to remain locked.

You configure login retry options at the [edit system login retry-options] hierarchy level. Junos OS Evolved allows three unsuccessful login attempts before the device disconnects the user. You cannot modify the default threshold for failed login attempts.

The lockout-period statement instructs the device to lock the user account for the specified amount of time if the user reaches the threshold of unsuccessful login attempts. The lock prevents the user from performing activities that require authentication, until the lockout time period has elapsed or a system administrator manually clears the lock. Any existing locks are ignored when the user attempts to log in from the local console.

To configure login retry options:

Configure the number of minutes that the user account remains locked after a user reaches the threshold of failed login attempts.
```
[edit system login retry-options]
user@host# set lockout-period minutes
```
For example, to lock a user account for 120 minutes after a user reaches the threshold of failed login attempts:
```
[edit system login retry-options]
user@host# set lockout-period 120
```

Commit the configuration.

content_copy zoom_out_map
[edit system login retry-options]
user@host# commit

Note:

To clear the console during an administrator-initiated logout, include newline (\n) characters when you configure the message statement at the [edit system login] hierarchy level. To completely clear the console, the administrator can enter 50 or more \n characters in the message string. For example:

content_copy zoom_out_map
user@host# set system login message "\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Welcome to Junos!!!"

arrow_backward PREVIOUS Login Classes Overview

NEXT arrow_forward User Accounts

User Access and Authentication Administration Guide for Junos OS Evolved

ON THIS PAGE

Login Settings

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry