When user type "show policy ?" in CLI, Junos wrongly escalated user privilege as user root
/// Below is the log file to check this behavior in this sample:
set system syslog file test-auth-issue authorization any
set system syslog file test-auth-issue interactive-commands any
/// When user "user1" types "show policy ?) or "show policy R?) for auto-complete, We can see the behavior show up in the logs with user root kicked in
user1@mx960> set cli timestamp
Jun 24 12:02:10
CLI timestamp set to: %b %d %T
{master}
user1@mx960> show policy ?
Jun 24 12:02:18
Possible completions:
<[Enter]> Execute this command
<policy> Name of policy
ARBOR-EXPORT
[,,,]
conditions Show conditions used by policy
damping Show state of route flap damping
logical-system Name of logical system, or 'all'
rib-sharding Name of rib shard
statistics Statistics for policy
| Pipe through a command
user1@mx960> show policy REJECT-ALL (hit <tab> after 'J' to autocomplete)
Jun 24 12:02:33
Policy REJECT-ALL: [RESOLVED/]
Term REJECT-ALL:
then reject
user1@mx960>
/// User1 Authenticated and typed command set cli timestamp
Jun 24 12:01:58 mx960 mgd[37209]: UI_AUTH_EVENT: Authenticated user 'user1' assigned to class 'j-super-user'
Jun 24 12:01:58 mx960 mgd[37209]: UI_LOGIN_EVENT: User 'user1' login, class 'j-super-user' [37209], ssh-connection '<SRC-IP> 57596 10.0.121.1 22', client-mode 'cli'
Jun 24 12:02:10 mx960 mgd[37209]: UI_CMDLINE_READ_LINE: User 'user1', command 'set cli timestamp '
///[This is where we requested help with: show policy ?] - Wrongly Authenticated as user root now.
Jun 24 12:02:19 mx960 mgd[37311]: UI_AUTH_EVENT: Authenticated user 'root' assigned to class 'super-user' <<<==escalated privilege as user root
Jun 24 12:02:19 mx960 mgd[37311]: UI_LOGIN_EVENT: User 'root' login, class 'super-user' [37311], ssh-connection '<SRC-IP> 57596 10.0.121.1 22', client-mode 'cli'
Jun 24 12:02:19 mx960 mgd[37311]: UI_CMDLINE_READ_LINE: User 'root', command 'show policy '
Jun 24 12:02:19 mx960 mgd[37311]: UI_LOGOUT_EVENT: User 'root' logout
/// [This is where we autocompleted with: show policy REJ<tab>] - - Wrongly Authenticated as user root now.
Jun 24 12:02:27 mx960 mgd[37375]: UI_AUTH_EVENT: Authenticated user 'root' assigned to class 'super-user' <<<==escalated privilege as user root
Jun 24 12:02:27 mx960 mgd[37375]: UI_LOGIN_EVENT: User 'root' login, class 'super-user' [37375], ssh-connection '<SRC-IP> 57596 10.0.121.1 22', client-mode 'cli'
Jun 24 12:02:27 mx960 mgd[37375]: UI_CMDLINE_READ_LINE: User 'root', command 'show policy '
Jun 24 12:02:27 mx960 mgd[37375]: UI_LOGOUT_EVENT: User 'root' logout
/// Back at CLI in user1 context with 'show policy REJECT-ALL' as the active string
Jun 24 12:02:33 mx960 mgd[37209]: UI_CMDLINE_READ_LINE: User 'user1', command 'show policy REJECT-ALL '
Jun 24 12:02:38 mx960 mgd[37209]: UI_CMDLINE_READ_LINE: User 'user1', command 'quit '
Jun 24 12:02:38 mx960 mgd[37209]: UI_LOGOUT_EVENT: User 'user1' logout
This is fixed through PR1965924 - Junos escalated user privilege as user root, returns the help info or autocompletion When trying to get help for a command