Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

User Accounts and Authentication

This topic explains how to create user accounts and define authentication methods to determine who can log in to the system, how they are verified, and what actions can they perform on the device.

After you have completed the system configuration of hostname, time zone, and the identity of your SRX400 firewall series in the network, you can create user accounts and authentication methods. Doing so allows you to determine who can log in to the system, how the users are verified, and what actions the users can perform on the device.

A user account is an identity created on the device that allows someone to access it and includes username, password (or authentication method), and login class (permission level). For more information, see User Accounts.

Authentication is the process of verifying the user's identity before granting access. For more information, see User Authentication Overview.

Local User Account

This authentication method is the simplest, where username and password stored on the device. You can create a user and define permission and system access using login classes. For more information, see User Accounts and Login Classes.

Example: Create Admin User

SSH Key Authentication

On the SRX400 firewall series, SSH key authentication is supported for the root user. You can set an SSH public key (RSA, ECDSA, or ED25519) as the root authentication method instead of a password.

Note:
  • For the initial factory-default setup on SRX400 firewall series; the device ships with basic security zones (trust or untrust).
  • Ensure the public key is properly formatted without line breaks.
  • For production, consider additional SSH hardening (e.g., protocol-version v2, root-login deny) and user accounts beyond root.

  1. Access the CLI: Log in as root via console (no initial password). Enter CLI configuration mode:

  2. Specify root authentication with SSH Public Key:

    Or use the set system root-authentication ssh-rsa <public-key-string> command, replacing <public-key-string> with your ECDSA, ED25519, and RSA public key (e.g., ssh-rsa AAAAB3NzaC1yc2E...).

  3. Configure Management Interface (required for SSH access):

  4. Set Default Route:

  5. Enable SSH Services (if not already default):

    For evaluated configurations, specify allowed algorithms (e.g., hostkey-algorithm, key-exchange, macs, ciphers).

  6. Disable or Restrict Root SSH Access.

    After adding a non-root user, enhance security by restricting root SSH access using these options:

Verification

  • Verify the SSH login details using the show configuration system services ssh and ssh -i <private-key> root@<management-ip> commands.
  • View your configurations using the show system root-authentication or show configuration system services ssh commands.

RADIUS Authentication

This type of authentication uses a centralized server to authenticate users who attempt to access a network device. This method is common in telecom networks. For more information, see RADIUS Authentication.

Configure a RADIUS server:

Configure the authentication order:

This means, try the RADIUS method of authentication first, and if that fails, use the local user authentication method.

TACACS+ Authentication

This type of authentication is an alternate method of authenticating when you attempt to access a network device. TACACS+ provides authentication and command authorization. For more information, see TACACS+ Authentication.

Configure a TACACS+ server:

Configure the authentication order:

This means, try the TACACS+ authentication first, and if that fails, use the RADIUS server authentication. If RADIUS authentication fails, then use the local user authentication method.