This article provides information on how to make a user of login classes to create a user with restricted permissions.

• Username: test
• A custom login class test _class to restrict permissions.
• Apply the login class to the test user, so that it only has show permissions.

For more information on login classes, refer to the following link:

https://www.juniper.net/documentation/en_US/junos12.3x48/information-products/pathway-pages/security/security-swconfig-initial-device-config.html

You can make use of the view-configuration permission category, which is set as a base for permissions, for the custom login class and then deny individual commands that are not required from the set, using regular expression. For more information on allowing and denying individual commands, please refer to the following link:

https://www.juniper.net/techpubs/en_US/junos12.3x48/topics/task/configuration/access-privileges-levels.html


Example Configuration:

set system login class test_class permissions view-configuration   <----- User permission set "view configuration"
set system login class test_class allow-commands show    <----- allow only show commands
set system login class test_class deny-commands "(clear)|(file)|(file show)|(help)|(load)|(monitor)|(op)|(request)|(save)|(set)|(start)|(test)" <----- deny all other individual permissions
set system login class test_class allow-configuration show   <---- allow only show configuration commands
set system login class test_class deny-configuration all <----- deny all other available configuration comm
set system login user test uid 2007
set system login user test class test_class
set system login user test authentication encrypted-password "$ABC123"

test@srx> ?
Possible completions:
quit Exit the management session
set Set CLI properties, date/time, craft interface message
show Show system information

• Can a user have rights to only view the security policy from zone A to zone B and nothing else?