> For the complete documentation index, see [llms.txt](https://jncia-workbook.gitbook.io/workbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jncia-workbook.gitbook.io/workbook/junos-basics/19-local-users.md).
# 19) Local Users
### Pre-Work
If you made any changes, you can quickly revert the lab using the **load\_config\_on\_nodes.py** script.
```
python3 load_config_on_nodes.py --lab_dir three-routers --config_filename basic.addressing.cfg
```
### Lab
Connect to R1, and configure a local user with username `automation-runner` and password `password123`. This local user should be able to run show commands and pings/traceroutes, but not change the configuration.
### Answer
Expand to reveal
We must create the user and assign the class `operator`:
```
set system login user automation-runner authentication plain-text-password
New password:
Retype new password:
set system login user automation-runner class operator
```
\
Login with this new user, and verify that it can run show commands and pings/traceroutes, but not edit the config:
```
clab@clab:~/jncia-junos-labs$ ssh automation-runner@10.200.255.2
(automation-runner@10.200.255.2) Password:
Last login: Tue Jul 14 19:37:14 2026 from 10.200.255.1
--- JUNOS 25.4R1.12 Kernel 64-bit JNPR-15.0-20251024.861cae5_buil
automation-runner@R1> show interfaces ge-0/0/0.0 terse
Interface Admin Link Proto Local Remote
ge-0/0/0.0 up up inet 10.1.2.1/24
inet6 2001:db8:1:2::1/64
fe80::aac1:abff:fe14:e78d/64
multiservice
automation-runner@R1> ping 10.1.2.2
PING 10.1.2.2 (10.1.2.2): 56 data bytes
64 bytes from 10.1.2.2: icmp_seq=0 ttl=64 time=2.552 ms
^C
--- 10.1.2.2 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max/stddev = 2.552/2.552/2.552/0.000 ms
automation-runner@R1> configure
^
unknown command.
automation-runner@R1>
```
### Explanation
Expand to reveal
When configuring local users, we must assign them to a login class. Without this, we cannot commit the changes:
```
[edit]
admin@R1# set system login user test1 authentication plain-text-password
New password:
Retype new password:
[edit]
admin@R1# commit
[edit system login]
'user test1'
Missing mandatory statement: 'class'
error: commit failed: (missing mandatory statements)
[edit]
admin@R1#
```
\
There are four built-in user classes:
* `super-user` - Root permission
* `operator` - View, clear, network, reset, and trace permissions
* `read-only` - View permissions only
* This option would not be valid to solve this lab, as it lacks the ability to run network tools such as ping and traceroute.
* `unauthorized` - No permissions
* Some reasons why you might use this:
* To setup a new user but not give them any permissions yet
* As a way to "deactivate" a previously valid user to track if they ever login again
* For use with RADIUS/TACACS, allowing the user access to some devices but not others
\
We can also create our own custom class using the `login class` configuration. For example:
```
set system login class audit-admin permissions security
set system login class audit-admin permissions trace
set system login class audit-admin permissions maintenance
set system login class audit-admin allow-commands "^clear (log|security log)"
set system login class audit-admin deny-commands "^clear (security alarms|system login lockout)|^file (copy|delete|rename)|^request (security|system set-encryption-key)|^rollback|^set date|^show security (alarms|dynamic-policies|match-policies|policies)|^start shell";
set system login class audit-admin security-role audit-administrator
set system login user audit-officer class audit-admin
```
Source:
### Further Reading