User Access and Authentication Administration

Create user accounts and define authentication methods to determine who can log in to the system, how they are verified, and what actions can they perform on the device.

User Accounts and Authentication

Create user accounts and define authentication methods to determine who can log in to the system, how they are verified, and what actions can they perform on the device.

After you have completed the system configuration of hostname, time zone, and the identity of your SRX4700 Firewall in the network, you can create user accounts and authentication methods. Doing so allows you to determine who can log in to the system, how the users are verified, and what actions the users can perform on the device.

A user account is an identity created on the device that allows someone to access it and includes username, password (or authentication method), and login class (permission level). For more information, see User Accounts.

Authentication is the process of verifying the user's identity before granting access. For more information, see User Authentication Overview.

Local User Account

This authentication method is the simplest, where username and password stored on the router. You can create a user and define permission and system access using login classes. For more information, see User Accounts and Login Classes.

Example: Create Admin User

SSH Key Authentication

On the Juniper Networks SRX4700 Firewall, SSH key authentication is supported for the root user. You can set an SSH public key (DSA or RSA) as the root authentication method instead of a password.

Note:
  • For the initial factory-default setup on SRX4700 Firewall; the device ships with basic security zones (trust or untrust).
  • Ensure the public key is properly formatted without line breaks.
  • For production, consider additional SSH hardening (such as protocol-version v2, root-login deny) and user accounts beyond root.

  1. Access the CLI: Log in as root through console (no initial password). Enter CLI configuration mode:

  2. Set Root Authentication with SSH Public Key:

    Or use the set system root-authentication ssh-rsa <public-key-string> command, replacing <public-key-string> with your DSA or RSA public key (such as ssh-rsa AAAAB3NzaC1yc2E...).

  3. Configure Management Interface (required for SSH access):

  4. Set Default Route:

  5. Enable SSH Services (if not already default):

    For evaluated configurations, specify allowed algorithms (such as hostkey-algorithm, key-exchange, macs, ciphers).

  6. Disabling or Restricting Root SSH Access

    After adding a non-root user, enhance security by restricting root SSH access using these options:

Verification

  • Verify the SSH login details using the show configuration system services ssh and ssh -i <private-key> root@<management-ip> commands.
  • View your configurations using the show system root-authentication or show configuration system services ssh commands.

RADIUS Authentication

This type of authentication uses a centralized server to authenticate users who attempt to access a network device. This method is common in telecom networks. For more information, see RADIUS Authentication.

Configure a RADIUS server:

Configure the authentication order:

This means, try the RADIUS method of authentication first, and if that fails, use the local user authentication method.

TACACS+ Authentication

This type of authentication is an alternate method of authenticating when you attempt to access a network device. TACACS+ provides authentication and command authorization. For more information, see TACACS+ Authentication.

Configure a TACACS+ server:

Configure the authentication order:

This means, try the TACACS+ authentication first, and if that fails, use the RADIUS server authentication. If RADIUS authentication fails, then use the local user authentication method.