Support Support Downloads Knowledge Base Case Manager My Juniper Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

Type: Event: {User '(unauthenticated user)' used JUNOScript client to run command 'request-authentication user=root'} messages in the log

0

0

Article ID: KB12783 KB Last Updated: 28 Dec 2018Version: 4.0
Summary:
What does "User '(unauthenticated user)' used JUNOScript client to run command 'request-authentication user=root' in messages log mean?
Symptoms:
Excerpt from 'show log messages':

Nov 16 11:50:07 Router mgd[6744]: UI_JUNOSCRIPT_CMD: User  '(unauthenticated user)' used JUNOScript client to run command 'request-authentication user=root'
Nov 16 11:50:07 Router mgd[6744]: UI_AUTH_EVENT: Authenticated user 'root' at permission level 'super-user'
Nov 16 11:50:07 Router mgd[6744]: UI_LOGIN_EVENT: User 'root' login, class 'super-user' [6744]
Nov 16 11:50:07 Router mgd[6744]: UI_JUNOSCRIPT_CMD: User 'root'  used JUNOScript client to run command 'get-system-alarm-information'
Nov 16 11:50:08 Router mgd[6744]: UI_JUNOSCRIPT_CMD: User 'root'  used JUNOScript client to run command 'request-web-management-update session-id=d5032d681c21d36b5358be9e87f9da60238f02fe'
Nov 16 11:50:08 Router mgd[6744]: UI_JUNOSCRIPT_CMD: User 'root'  used JUNOScript client to run command 'get-chassis-inventory'
Nov 16 11:50:08 Router mgd[6744]: UI_JUNOSCRIPT_CMD: User 'root'  used JUNOScript client to run command 'get-software-information'
Nov 16 11:50:08 Router mgd[6744]: UI_JUNOSCRIPT_CMD: User 'root'  used JUNOScript client to run command 'get-system-uptime-information'
Nov 16 11:50:08 Router mgd[6744]: UI_CHILD_START: Starting child '/usr/bin/uptime'
Nov 16 11:50:08 Router mgd[6744]: UI_CHILD_STATUS: Cleanup child '/usr/bin/uptime', PID 6746, status 0
Nov 16 11:50:08 Router mgd[6744]: UI_JUNOSCRIPT_CMD: User 'root'  used JUNOScript client to run command 'get-system-users-information'
Nov 16 11:50:08 Router mgd[6744]: UI_CHILD_START: Starting child '/usr/bin/w'
Nov 16 11:50:08 Router mgd[6744]: UI_CHILD_STATUS: Cleanup child '/usr/bin/w', PID 6747, status 0
Nov 16 11:50:08 Router mgd[6744]: UI_CHILD_START: Starting child '/usr/sbin/httpd-gk'
Nov 16 11:50:08 Router mgd[6744]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/httpd-gk', PID 6748, status 0
Nov 16 11:50:08 Router mgd[6744]: UI_JUNOSCRIPT_CMD: User 'root'  used JUNOScript client to run command 'get-process-information minimum-run-time=20'
Nov 16 11:50:08 Router mgd[6744]: UI_CHILD_START: Starting child '/usr/sbin/jps'


 
Cause:
JWeb logins appear as a JUNOScript client '(unauthenticated user)'. The JWeb client uses JUNOScript to log the username/password that was entered at the JWeb prompt. The username and password are authenticated thereafter.

These logs are also seen when running "show" commands from SSH and console.
Solution:
These messages are normal. The user is authenticated and it is not an indication of a breach of the router's security.

If desired, to suppress these logs the following command can be added:
set system syslog file messages match "!(.*UI_JUNOSCRIPT_CMD.*)"

 
Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search