Excerpts from matthew zeier's message of Thu Feb 04 09:14:52 -0800 2010:
> Not clear how to create a dumbed down read-only user who can just view the
> config.
>
> In a Cisco world I'd use "privilege exec level" . In JunOS, a read-only
> class can't run "show configuration".
>
> What's the nugget of info I'm missing?
Define a system login class that includes the "view" and
"view-configuration" permissions. You could also explicitly place a
regexp in the class to allow certain CLI command patterns to be allowed.
This could be useful if you're also setting rancid to fetch things other
than the configuration.
For example:
system {
login {
class only-see-config {
permissions [ view view-configuration ];
}
user rancid {
class only-see-config;
authentication {
........
}
}
}
_______________________________________________
juniper-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/juniper-nsp
