CloudLabBox
Try the free demo

JNCIA-Junos lab 5 of 15

User accounts and login classes

Give three teams the access they need and nothing more: a read-only help desk, a NOC that can look and ping, and network operators who can change interfaces but never the loopback. Then add an SSH key, put RADIUS in front of the local accounts and lock down repeated login failures.

Run this lab

It needs Lite: its 1 node is set to 4 vCPU and 5,120 MB in total. That fits the free demo too.

In your workspace: Shared, then JNCIA-Junos JN0-106 guided labs, then 05 - User accounts and login classes

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Beginner
Time
About 50 minutes
Nodes need
4 vCPU, 5,120 MB
Smallest plan
Lite

The scenario

Ashby Freight's IT team is growing, and everyone has been sharing the lab super-user account. Security wants named accounts with the least privilege each person needs, a central RADIUS server in front of the local accounts, and limits on password guessing.

AccountLogin classPasswordWho and what
helpdeskread-only (predefined)help123First-line support: look, never change
noc1NOC (you create it)noc123Monitoring: look at everything, ping and traceroute
ops1NETOPS (you create it)ops123, plus an SSH keyNetwork operator: change interfaces and routing, never the loopback

The RADIUS server will be 10.1.0.50 on the Office LAN, shared secret Ashby-Radius-2026. It has not been installed yet, which is useful: you will see exactly what Junos does when RADIUS does not answer.

What you’ll practise

  • Explain the four predefined login classes and the permission flags behind them
  • Create custom login classes with permissions, allow-commands, deny-configuration and an idle timeout
  • Create local accounts with passwords and SSH public keys
  • Configure RADIUS with a local fallback and explain what the authentication order does when the server rejects or does not answer
  • Limit login attempts and enforce a minimum password length

The tasks

  1. Look at your own permissions and the predefined classes
  2. A read-only account for the help desk
  3. A custom class for the NOC
  4. A class that may change interfaces but not the loopback
  5. Add an SSH key for ops1
  6. RADIUS first, local accounts as the fallback
  7. Lock down login attempts
  8. Test every account

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of User accounts and login classes1 node and 1 network, 1 link. Every link is listed as text below the diagram.HQOffice-LANge-0/0/2
1 node and 1 network, with the interface names each link uses.
Every link, as text
  • HQ ge-0/0/2 to Office-LAN (network)
Nodes in User accounts and login classes, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
HQJuniper vJunos-routervjunosrouter-24.2R1-S2.54 vCPU, 5,120 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder JNCIA-Junos JN0-106 guided labs.

  3. Open 05 - User accounts and login classes and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More JNCIA-Junos labs

All JNCIA-Junos labs

Related labs in other courses

CloudLabBox is independent of Juniper Networks. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.