Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

User Access and Authentication Administration

Create user accounts and define authentication methods to determine who can log in to the system, how they are verified, and what actions can they perform on the device.

User Accounts and Authentication

Create user accounts and define authentication methods to determine who can log in to the system, how they are verified, and what actions can they perform on the device.

After you have completed the system configuration of hostname, time zone, and the identity of your SRX4700 Firewall in the network, you can create user accounts and authentication methods. Doing so allows you to determine who can log in to the system, how the users are verified, and what actions the users can perform on the device.

A user account is an identity created on the device that allows someone to access it and includes username, password (or authentication method), and login class (permission level). For more information, see User Accounts.

Authentication is the process of verifying the user's identity before granting access. For more information, see User Authentication Overview.

Local User Account

This authentication method is the simplest, where username and password stored on the router. You can create a user and define permission and system access using login classes. For more information, see User Accounts and Login Classes.

Example: Create Admin User

SSH Key Authentication

On the Juniper Networks SRX4700 Firewall, SSH key authentication is supported for the root user. You can set an SSH public key (DSA or RSA) as the root authentication method instead of a password.

Note:
  • For the initial factory-default setup on SRX4700 Firewall; the device ships with basic security zones (trust or untrust).
  • Ensure the public key is properly formatted without line breaks.
  • For production, consider additional SSH hardening (such as protocol-version v2, root-login deny) and user accounts beyond root.

  1. Access the CLI: Log in as root through console (no initial password). Enter CLI configuration mode:

  2. Set Root Authentication with SSH Public Key:

    Or use the set system root-authentication ssh-rsa <public-key-string> command, replacing <public-key-string> with your DSA or RSA public key (such as ssh-rsa AAAAB3NzaC1yc2E...).

  3. Configure Management Interface (required for SSH access):

  4. Set Default Route:

  5. Enable SSH Services (if not already default):

    For evaluated configurations, specify allowed algorithms (such as hostkey-algorithm, key-exchange, macs, ciphers).

  6. Disabling or Restricting Root SSH Access

    After adding a non-root user, enhance security by restricting root SSH access using these options:

Verification

  • Verify the SSH login details using the show configuration system services ssh and ssh -i <private-key> root@<management-ip> commands.
  • View your configurations using the show system root-authentication or show configuration system services ssh commands.

RADIUS Authentication

This type of authentication uses a centralized server to authenticate users who attempt to access a network device. This method is common in telecom networks. For more information, see RADIUS Authentication.

Configure a RADIUS server:

Configure the authentication order:

This means, try the RADIUS method of authentication first, and if that fails, use the local user authentication method.

TACACS+ Authentication

This type of authentication is an alternate method of authenticating when you attempt to access a network device. TACACS+ provides authentication and command authorization. For more information, see TACACS+ Authentication.

Configure a TACACS+ server:

Configure the authentication order:

This means, try the TACACS+ authentication first, and if that fails, use the RADIUS server authentication. If RADIUS authentication fails, then use the local user authentication method.

hjfghjhj

How to Recover the Root Password for Junos OS

If you forget the root password for the router, you can use the password recovery procedure to reset the root password.

Before you begin, note the following:

  • You need console access to recover the root password.

To recover the root password:

  1. Power off the router by pressing the power button on the front panel.
  2. Turn off the power to the management device (usually a computer) that you use to access the CLI.
  3. Plug one end of the Ethernet rollover cable (supplied with the router) into the RJ-45 to DB-9 serial port adapter supplied with the router.
  4. Plug the RJ-45 to DB-9 serial port adapter into the serial port on the management device.
  5. Connect the other end of the Ethernet rollover cable to the console port on the router.
  6. Turn on the power to the management device.
  7. From the management device, start your asynchronous terminal emulation application (such as Microsoft Windows Hyperterminal), and select the appropriate COM port to use (for example, COM1).
  8. Configure the port settings as follows:

    • Bits per second: 9600

    • Data bits: 8

    • Parity: None

    • Stop bits: 1

    • Flow control: None

  9. Power on the router by pressing the power button on the front panel.

    Verify that the POWER LED on the front panel turns green.

    The terminal emulation screen on your management device displays the router’s boot sequence.

  10. When the following prompt appears, press the Spacebar to access the router’s bootstrap loader command prompt.
    Note:

    Depending on your device hardware, the bootstrap loader might proceed quickly at this step without pausing for input. Pay close attention to the prompts that appear and press the Spacebar immediately after seeing the above prompt flash on the screen.
  11. At the following prompt, type boot -s to start the system in single-user mode.
  12. At the following prompt, type recovery to start the root password recovery procedure.
  13. Enter configuration mode in the CLI.
  14. Set the root password.

    When you configure a plain-text password, the system encrypts the password for you.

    CAUTION:

    Avoid using the encrypted-password option unless the password is already encrypted and you are entering the encrypted version of the password. If you commit the encrypted-password option with a plain-text password or with blank quotation marks (" "), you will not be able to log in to the device as root, and you will need to repeat this password recovery process.
  15. At the following prompt, enter the new root password. For example:
  16. At the second prompt, reenter the new root password.
  17. After you have finished configuring the password, commit the configuration.
  18. Exit configuration mode in the CLI.
  19. Exit operational mode in the CLI.
  20. At the prompt, type y to reboot the router.