To create a new class you can issue the following commands from the [edit system login] hierarchy. In this example, we create a new class named 'remote', granting only view permissions, and assign the remote user to the new class. More detailed permissions will be added to these permissions [edit system login] user@host#set class remote permissions [ view ] (this class should also have Idle timeouts and other options set in line with other recommendations in this section). To change the class for a user account, use the following command under the [edit system login] hierarchy: [edit system login] user@host#set user remote class remote A full discussion of RADIUS or TACACS+ configuration and options is beyond the scope of this guide, but a simple example of using a TACACS.net server running on Windows with AD integration for a remote user is shown below. This example is taken from an anonymized real world deployment, so also includes sections to allow access to different groups of TACACS+ Clients and permissions for Cisco IOS and Netscreen devices. The most relevant section is the for service=junos-exec, where the VSAs for TACACS+ Clients running JUNOS are defined, but the entire Authorization for this Class is given for context. GRP-NETOPS CORE-NET ACCESS-NET FIREWALLS show.* terminal.* get.* .* service=junos-exec local-user-name=remote allow-commands=show.* user-permissions=view-configuration user-permissions=network priv-lvl=15 Default Value: By default all users are, in effect, members of the super-user class.

Name	Audit Name	Plugin	Category
6.6.7 Ensure Remote Login Class for Authorization through External AAA - login class	CIS Juniper OS Benchmark v2.1.0 L2	Juniper	IDENTIFICATION AND AUTHENTICATION
6.6.7 Ensure Remote Login Class for Authorization through External AAA - remote class	CIS Juniper OS Benchmark v2.1.0 L2	Juniper	IDENTIFICATION AND AUTHENTICATION

Detections

Analytics

Item Search