Users logging in as root user and or doing a switch user to root user fails with Junos 10.0 onwards:

Error that the user is not accepted:
=============================

test@fw1> start shell
% su
Password:
su: Sorry
% exit
exit


Configuration reference:
================================
system {
     authentication-order radius;
         radius-server {
             192.168.1.124 {
                 port 1812;
                 source-address 192.168.1.241;
             }
         }
}
login {
     class t1 {
         idle-timeout 20;
     }
     user remote {
         uid 2004;
         class t1;
     }
}




From Junos 10.0 onwards, with the configuration specifying only RADIUS authentication, all users including the root user, will need to be authenticated by the RADIUS server:

Configuration reference:
============================
system {
     authentication-order radius;
}

Logs from messages file showing the authentication process when a user tries to do a switch user to the root user:

Dec 11 05:16:39 fw1j mgd[8946]: UI_CMDLINE_READ_LINE: User 'test', command 'start shell '
Dec 11 05:16:42 fw1j su: Added radius server 192.168.1.124 (192.168.1.124)
Dec 11 05:16:42 fw1j su: sendmsg to 192.168.1.124(192.168.1.124).1812: h->try:0 serv->num_tries:0, serv->max_tries:3 tries_per_addr:3, nleft:3, cur_addr:0
Dec 11 05:16:42 fw1j su: noc to root on /dev/ttyd0

From the above logs, we see that the device sends an authentication request to the RADIUS server when the user tries to do a switch user to root user.

Before Junos 10.0, the above configuration worked, and the users are able to su to the root user. This is because of an issue where the switch user does not trigger the device to send an authentication request to the RADIUS server despite the configuration.

The behavior was incorrect prior to Junos 10.0.

The behaviour for switch user prior to Junos 10.0 releases was incorrect and has been corrected in Junos 10.0 and above such that all users, including switch user commands when configured with the following will have to be authenticated via the RADIUS server:

system {
     authentication-order radius;     
}

The current workaround/solution for customers who have this existing configuration is to do either of the following:

• Configure the authentication order to include the local password on the device thus bypassing RADIUS authentication

OR

• Configure root user on the RADIUS server for authentication requests