This article explains why a local Junos user may be unable to access shell mode using the start shell command, while the root user can access shell mode successfully.

In Junos OS, local user permissions are controlled by the login class assigned to the user under system login. The start shell command requires the assigned login class to include the shell or maintenance permission.

The recommended minimum permission for allowing shell access is shell. The maintenance permission also allows shell access, but it provides broader system maintenance privileges and should be used only when required.

This behavior is expected when the local user belongs to a login class that does not include the required shell access permission.

• A local user can successfully log in to the Junos CLI, but the start shell command does not open shell mode.

Example:

user@switch> start shell

^

syntax error

• The same command works when logged in as the root user:

root@switch> start shell

%

• The issue is observed only for local users assigned to a restricted login class.

• Verify the login class assigned to the affected local user:

user@switch> show configuration system login user <username>

• Verify the permissions configured under the login class:

user@switch> show configuration system login class <class-name>

• To allow shell access, configure the user's login class with the shell permission.

Example:

user@switch> configure

user@switch# set system login class shell-access permissions [ view shell ]

user@switch# set system login user <username> class shell-access

user@switch# commit

• After committing the change, log out and log back in with the local user.
• Verify the user's authorization:

user@switch> show cli authorization

• Test shell access:

user@switch> start shell

%

• The shell permission allows the user to run start shell. This does not make the user equivalent to root. It only allows the user to enter the UNIX shell as that user.
• If broader maintenance-level privileges are required, the maintenance permission can also allow shell access. However, maintenance includes additional system maintenance privileges, so the shell permission is the recommended minimum permission for this requirement.

• Example using maintenance, only if required:

user@switch> configure

user@switch# set system login class maintenance-access permissions [ view maintenance ]

user@switch# set system login user <username> class maintenance-access

user@switch# commit

• If the requirement is to prevent shell access, make sure the user's login class does not include shell, maintenance, or all permissions.
• An explicit deny command can also be configured as an additional restriction (compatible with regex):

user@switch> configure

user@switch# set system login class <class-name> deny-commands "^start shell.*"

user@switch# commit

Further information listed here

> User Access Privileges | Junos OS | Juniper Networks |

using with regex

> class (Defining Login Classes) | Junos OS | Juniper Networks