Description
Permission flags to allow the users in a customized login class to reset his/her SSH password
Symptoms
A customer would like to allow the users in a customized login class to be able to reset the SSH password to SRX firewalls
Solution
The user privileges are controlled by the belonged login class. There are different permission flags available under a login class hierarchy to control the user access.
User Access Privileges | Junos OS | Juniper Networks
The permission flag to control the user authentication is the 'admin-control' (with modification access), while the 'admin' permission flag allows the capability of 'review' only. With the 'admin-control' access, the user would be ale to access the system login hierarchy and change the user authentication.
admin-control | Junos OS | Juniper Networks
However, if the login class is entitle with the 'admin-control' without 'configure' permission, the user would not be able to access the 'edit/config' mode to make any device changes. Therefore, an additional 'configure' permission flag must be added.
configure | Junos OS | Juniper Networks
[edit system login class xxxxxx]
# show
permissions [ admin-control ] <<<<---------without 'configure' permission
[edit system login class xxxxxx]
# show
permissions [ admin-control configure ] <<<<---------with 'configure' permission
Modification History
Pub
2025-04-07 - Corrected categories
How to allow a user to reset the SSH password to SRX firewalls