Junos restricted user disallow "ping rapid" and "ping size" operational commands
The following Junos directive will block a Junos user from making use of "rapid" and "size" ping arguments on the CLI.
Code:
allow-commands = "(^show route)|(^show route .*)|(^quit)|(^ping ([^r|s]).+)|(^traceroute .*)|(^show bgp summary)"
And the outcome:
Code:
juniper@CORE_R1> ping ?
Possible completions:
<host> Hostname or IP address of remote host
atm Ping remote Asynchronous Transfer Mode node
bypass-routing Bypass routing table, use specified interface
count Number of ping requests to send (1..2000000000 packets)
detail Display incoming interface of received packet
do-not-fragment Don't fragment echo request packets (IPv4)
inet Force ping to IPv4 destination
inet6 Force ping to IPv6 destination
interface Source interface (multicast, all-ones, unrouted packets)
interval Delay between ping requests (seconds)
logical-system Name of logical system
+ loose-source Intermediate loose source route entry (IPv4)
mpls Ping label-switched path
no-resolve Don't attempt to print addresses symbolically
pattern Hexadecimal fill pattern
tos IP type-of-service value (0..255)
ttl IP time-to-live value (IPv6 hop-limit value) (1..255 hops)
verbose Display detailed output
vpls Ping VPLS MAC address
wait Maximum wait time after sending final packet (seconds)
The drawback of this is that all arguments starting with "r" and "s" are left out by the regular expression.