# Create a read-only account on Juniper Junos

> Create a Junos login class and account that let ITVA collect data from a Juniper device without permission to change it.

Section: Devices / Vendors / Juniper  
Source: https://www.itva.com/docs/juniper/create-a-read-only-account-on-juniper-junos  
Last updated: 2026-11-02

A read-only account lets ITVA collect data from a Juniper device without the permission to change it. In this guide, you create a login class and an account for ITVA, then connect the device to ITVA.

## Before you begin

- SSH is on, and the probe host can reach the device on the SSH port.
- You can sign in to the device and commit configuration changes.

## What ITVA needs

ITVA signs in with SSH and stays in operational mode. It runs `show` commands, including `show configuration | display set`. It also sets CLI options for the session, such as `set cli screen-length 0`.

The built-in `read-only` class has only the `view` permission, which cannot show the configuration. So you create a class that adds `view-configuration`. This permission shows the configuration with secrets hidden.

## Create a login class

1. Enter configuration mode.

```
configure
```

2. Create the class.

```
set system login class itva-read-only permissions [ view view-configuration ]
```

## Create the account

1. Create the account. Replace `<USERNAME>` with the name of the account. Junos asks you for the password two times.

```
set system login user <USERNAME> class itva-read-only authentication plain-text-password
```

2. Commit the change.

```
commit and-quit
```

## Set up the device in ITVA

1. In the portal, open the device and select **Edit**.
2. In **Credentials**, add a credential with the **Username** and **Password** of the new account.
3. Set **Admin** to **No** for this credential, because the account cannot change the device.
4. Make sure **Management Port** is 22, or the SSH port that you set on the device.
5. Select **Save**.

## Check that it worked

1. On the device page, open the actions menu and select **Test Connection**.
2. Select **Sync Data**, then select **Sync**.
3. Make sure the log shows `sync succeeded` lines and no `sync failed` lines.

## Limits

This account supports syncing data only. ITVA tools that change the device need an account with more permissions. For example, OS upgrade validation and IS-IS interface changes do not work with this account.