Configuring a Login Class (SRC CLI)

Use the following configuration statements to configure login classes at the [edit] hierarchy level:

To configure a login class:

1. From configuration mode, access the configuration statement that configures login classes, and assign a name to the login class.
   [edit]user@host# edit system login class name
2. Specify the permissions for the login class.
   [edit system login class name ]user@host# set permissions permissions

   For example, the following statement specifies that the user-account class can configure and view only user accounts:

   [edit system login class user-accounts]user@host# set permissions [configure admin admin-control]

   The following statement specifies that the network-mgmt class can configure and view only SNMP parameters:

   [edit system login class network-mgmt]user@host# set permissions [configure snmp snmp-control]
3. (Optional) Configure access to specified operational mode commands that would otherwise be denied.
   [edit system login class name ]user@host# set allow-commands allow-commands

   For example, the following statement specifies that the network-mgmt class can install system software:

   [edit system login class network-mgmt]user@host# set allow-commands "request system install"
4. (Optional) Deny access to specified operational mode commands that would otherwise be allowed.
   [edit system login class class-name ]user@host# set deny-commands deny-commands

   For example, the following statement specifies that the remote class cannot connect to the SRC software through Telnet:

   [edit system login class remote]user@host# set deny-commands telnet
5. (Optional) Configure access to specified configuration mode commands that would otherwise be denied.
   [edit system login class name ]user@host# set allow-configuration allow-configuration

   For example, the following statement specifies that the network-mgmt class can issue configuration mode commands at the [routing-options] hierarchy level:

   [edit system login class network-mgmt]user@host# set allow-configuration “ routing options”
6. (Optional) Deny access to specified configuration mode commands that would otherwise be allowed.
   [edit system login class name ]user@host# set deny-configuration deny-configuration

   For example, the following statement specifies that the network-mgmt class does not have access to the [snmp address] hierarchy level:

   [edit system login class network-mgmt]user@host# set deny-configuration “ snmp address”
7. Specify the number of minutes that a session can be idle before it is automatically closed.
   [edit system login class class-name]user@host# set idle-timeout minutes
8. Display the results of the configuration.

   [edit system login]
   user@host# show
   

   class network-mgmt {
    allow-commands "request system install";
     allow-configuration routing-options;
   deny-configuration "snmp address";
   }
   class remote {
     deny-configuration "system services telnet";
     permissions all;
   }