services (System Services)
구문
services {
dhcp { # DHCP is not supported on a DCF
dhcp_services;
}
dtcp-only
finger {
connection-limit limit;
rate-limit limit;
}
flow-tap-dtcp {
ssh {
connection-limit limit;
rate-limit limit;
}
}
ftp {
authentication-order [authentication-methods];
connection-limit limit;
rate-limit limit;
}
grpc {
request-response {
grpc {
ssl {
address ip-address;
local-certificate local-certificate;
port port;
}
max-connections max-connections;
}
}
notification {
port port;
max-connections max-connections;
allow-clients {
address ip-address;
}
}
traceoptions {
file <filename> <files number> <match regex> <size size> <world-readable | no-world-readable>;
flag flag;
no-remote-trace;
}
}
netconf {
flatten-commit-results;
hello-message {
yang-module-capabilities {
advertise-native-yang-modules;
advertise-custom-yang-modules;
advertise-standard-yang-modules;
}
}
netconf-monitoring {
netconf-state-schemas {
retrieve-custom-yang-modules;
retrieve-standard-yang-modules;
}
}
notification;
rfc-compliant;
ssh {
client-alive-count-max number;
client-alive-interval seconds;
connection-limit limit;
port port;
rate-limit limit;
}
tls {
client-identity client-id {
fingerprint fingerprint;
map-type (san-dirname-cn | specified);
username username;
}
default-client-identity {
map-type (san-dirname-cn | specified);
username username;
}
local-certificate local-certificate;
traceoptions {
file <filename> <files files> <match match> <size size> <(world-readable | no-world-readable)>;
flag name;
level (all | error | info | notice | verbose | warning);
no-remote-trace;
}
}
traceoptions {
file <filename> <files number> <match regular-expression> <size size> <world-readable | no-world-readable>;
flag flag;
no-remote-trace;
on-demand;
}
yang-compliant;
yang-modules {
device-specific;
emit-extensions;
}
}
outbound-https {
client client-id {
address {
port port;
trusted-cert trusted-cert;
}
device-id device-id;
reconnect-strategy (in-order | sticky);
secret password;
waittime seconds;
}
}
service-deployment {
servers address {
port-number port-number;
}
source-address address;
}
ssh {
authentication-order [method 1 method2...];
authorized-keys-command authorized-keys-command;
authorized-keys-command-user authorized-keys-command-user;
ciphers [ cipher-1 cipher-2 cipher-3 ...];
client-alive-count-max number;
client-alive-interval seconds;
connection-limit limit;
fingerprint-hash (md5 | sha2-256);
hostkey-algorithm (algorithm | no-algorithm);
key-exchange [algorithm1 algorithm2...];
log-key-changes log-key-changes;
macs [algorithm1 algorithm2...];
max-pre-authentication-packets number;
max-sessions-per-connection number;
no-challenge-response;
no-password-authentication;
no-passwords;
no-public-keys;
allow-tcp-forwarding;
port port-number;
protocol-version [v2];
rate-limit number;
rekey {
data-limit bytes;
time-limit minutes;
}
root-login (allow | deny | deny-password);
sftp-server;
}
tcp-forwarding;
resource-monitor {
free-fw-memory-watermark number;
free-heap-memory-watermark number;
free-nh-memory-watermark number;
high-threshold number;
no-logging;
no-throttle;
resource-category jtree {
resource-category jtree (continguous-pages | free-dwords | free-pages) {
low-watermark number;
high-watermark number;
}
}
subscribers-limit {
(any | dhcp | l2tp | pppoe) {
{
limit limit;
}
{
limit limit;
}
fpc slot-number {
limit limit;
pic number {
limit limit;
port number {
limit limit;
}
}
}
}
}
traceoptions {
file filename <files number> <match regular-expression> <size maximum-file-size> <world-readable | no-world-readable>;
flag flag;
no-remote-trace;
}
}
subscriber-management {
enable (Enhanced Subscriber Management);
enforce-strict-scale-limit-license;
gres-route-flush-delay;
}
overrides {
event {
catastrophic-failure {
reboot (master | standby);
}
}
interfaces {
family (inet | inet6) {
layer2-liveness-detection;
}
}
no-unsolicited-ra;
ra-initial-interval-max seconds;
ra-initial-interval-min seconds;
shmlog {
disable;
file filename <files maximum-no-files> <size maximum-file-size>;
filtering enable;
log-name {
all;
logname {
<brief | detail | extensive | none | terse>;
<file-logging |no-file-logging>;
}
}
log-type (debug | info | notice);
|
}
redundancy {
interface name {
local-inet-address v4-address;
local-inet6-address v6-address;
shared-key string;
virtual-inet-address virtual-v4-address;
virtual-inet6-address virtual-v6-address;
}
no-advertise-routes-on-backup;
protocol {
pseudo-wire;
vrrp;
}
}
traceoptions {
file filename <files number> <match regular-expression > <size maximum-file-size> <world-readable | no-world-readable>;
flag flag;
}
}
telnet {
authentication-order [authentication-methods];
connection-limit limit;
rate-limit limit;
}
web-management {
http {
interfaces [ names ];
port port;
}
https {
interfaces [ names ];
local-certificate name;
port port;
}
session {
idle-timeout [ minutes ];
session-limit [ limit ];
}
}
xnm-ssl {
connection-limit limit;
local-certificate name;
rate-limit limit;
ssl-renegotiation;
}
}
계층 수준
[edit system]
설명
원격 시스템의 사용자가 DHCP 서버, SSH, 핑거, 아웃바운드 HTTPS, rlogin, SSH, telnet, 웹 관리, Junos XML 프로토콜 SSL 및 네트워크 유틸리티를 통해 로컬 라우터 또는 스위치에 액세스하거나 Junos OS 세션 및 리소스 제어(SRC) 소프트웨어와 작동하도록 라우터 또는 스위치를 구성합니다. 또한 JET(Juniper Extension Toolkit)를 사용하여 개발된 타사 애플리케이션을 Junos OS 실행할 수 있도록 합니다.
Junos OS 릴리스 22.2R1부터는 보안을 강화하기 위해 기본적으로 SSH TCP 포워딩 기능을 비활성화했습니다. SSH TCP 포워딩 기능을 활성화하려면 [edit system services ssh] 계층 수준에서 문을 구성할 allow-tcp-forwarding 수 있습니다. 또한 [edit system services ssh] 계층 수준에서 및 no-tcp-forwarding 명령문을 더 이상 사용되지 tcp-forwarding 않습니다.
나머지 문은 별도로 설명됩니다. CLI 탐색 기에서 문을 검색하거나 자세한 내용은 구문 섹션에서 연결된 문을 클릭합니다.
필수 권한 수준
system - 구성에서 이 명령문을 볼 수 있습니다.
system-control - 구성에 이 명령문을 추가합니다.
릴리스 정보
Junos OS 릴리스 7.4 전에 소개된 명령문입니다.
extension-service 옵션은 Junos OS 릴리스 16.1에서 MX80, MX104, MX240, MX480, MX960, MX2010, MX2020, vMX 시리즈에 추가되었습니다.
grpc 옵션은 Junos OS 릴리스 16.2에서 MX80, MX104, MX240, MX480, MX960, MX2010, MX2020, vMX 시리즈에 추가되었습니다.
allow-tcp-forwarding 옵션은 Junos OS 릴리스 22.2R1에 추가되었습니다.