​Junos Allow Root Login Over SSH

Allowing the root user to log in via SSH is a straightforward change, but it is not something I recommend. There is a better way of achieving the same outcome, which is to su to the root user.

Allowing Root Login Via SSH

To allow root to log in via SSH, we need to add the following command: set system services ssh root-login allow.

This is shown in the below example. First, we’ll show it not working, and then what happens when we allow root logins. Note that there is no central authentication being used in this example, just local user accounts.

The current ssh config on vMX-1 is as follows:

lab@vMX-1> show configuration system services 
ssh {
    protocol-version v2;
    connection-limit 5;
    rate-limit 5;
}

If we try to log in as root from a host called Linux-1, we get a password error.

eve@linux-1:~$ ssh [email protected]
([email protected]) Password:
([email protected]) Password:
([email protected]) Password:
Received disconnect from 192.168.20.1 port 22:2: Too many password failures for root
Disconnected from 192.168.20.1 port 22

Now we add the root-login allow statement.

lab@vMX-1> edit 
Entering configuration mode

[edit]
lab@vMX-1# set system services ssh root-login allow 

[edit]
lab@vMX-1# show system services 
ssh {
    root-login allow;
    protocol-version v2;
    connection-limit 5;
    rate-limit 5;
}

[edit]
lab@vMX-1# commit and-quit 
commit complete
Exiting configuration mode

lab@vMX-1>

And re-test logging in as root from Linux-1

eve@linux-1:~$ ssh [email protected]
([email protected]) Password:
Last login: Sun Dec  3 03:52:50 2023
--- JUNOS 20.4R3-S2.6 Kernel 64-bit  JNPR-11.0-20211117.c779bdc_buil
root@vMX-1:~ # cli
root@vMX-1> 

root@vMX-1>

There are some reasons why this might still fail, even if you do allow root logins. It depends on whether you are using RADIUS or TACACS authentication and what the authentication order is set to.

A Better Method For Logging In As Root

There is a better way of logging in as root, assuming you have a user account that can start a shell. That is to do the following:

• Log in as a regular user
• run start shell
• Then use ‘su -’ to switch to the root user, you will need to supply the root password
• Run ‘cli’ command to start the Junos CLI.

This is demonstrated below.

eve@linux-1:~$ ssh [email protected]
([email protected]) Password:
Last login: Thu Dec 28 05:21:12 2023 from 192.168.20.5
--- JUNOS 20.4R3-S2.6 Kernel 64-bit  JNPR-11.0-20211117.c779bdc_buil
lab@vMX-1> show cli authorization | match "Current user" 
Current user: 'lab         ' class 'super-user'

lab@vMX-1> start shell 
% su -
Password:
root@vMX-1:~ # cli
lab@vMX-1> show cli authorization | match "Current user" 
Current user: 'root' login: 'lab' class 'super-user'

lab@vMX-1>

Why You Should Avoid Setting Root-Login Allow On Junos

The root account is very powerful. When a Junos device is set up properly, you shouldn’t need to log in as root very often. For most production and lab networks, it is treated as an account of last resort, and several things need to have gone wrong for me to need to log in as root. When I do need to be the root user, I either use the console port or the su method described above. You do have remote access to your console port, don’t you?

That said, I don’t know your particular situation, so if you do have a legitimate need to enable root login via SSH, then you should do what you need to do.

I would recommend reviewing your lo0 interface units and ensuring all of them have a suitable firewall filter applied that allows SSH traffic only from the expected hosts.

Using SSH Keys

You can also use ssh key pairs to authenticate. If you do use key pairs, keep the following behavior in mind.

Root-login set to deny. Root cannot log in using either password or key-based authentication.

Root-login not specified. Root cannot log in using a password, but can use key-based authentication.

Root-login set to allow. Root can log in using either password or key-based authentication.