This sample chapter from CCNP and CCIE Enterprise Core ENCOR 350-401 Exam Cram reviews the configuration and verification of network device access control with usernames and passwords.It also covers authentication, authorization, and accounting (AAA), and looks at the configuration and verification of network device access control on Cisco IOS devices using TACACS+ and RADIUS. Show
This chapter is from the book This chapter is divided into two sections. The first section looks at the configuration and verification of network device access control with usernames and passwords. It also covers the configuration and verification of role-based access control (RBAC) using privilege levels. The second section covers authentication, authorization, and accounting (AAA). It looks at the configuration and verification of network device access control on Cisco IOS devices using TACACS+ and RADIUS. Cisco IOS CLI Session OverviewCisco IOS software provides several features that you can use to implement basic security for network devices’ command-line sessions. These features include:
You can establish IOS CLI sessions on Cisco IOS devices in two ways:
With Cisco IOS networking devices, the word “lines” is used to refer to the software components that manage local and remote CLI sessions. You use the line console 0 global configuration command to enter line configuration mode to configure options such as a password for the console port. Remote CLI sessions use lines that are referred to as vty lines. You use the line vty line-number [ending-line-number] global configuration command to enter line configuration mode to configure options such as a password for remote CLI sessions. Once you are in the line configuration mode, you can set the protocol you will be connecting over (for example, SSH). Example 6.1 shows the console, auxiliary, and vty lines in the running configuration that are available on R1. EXAMPLE 6.1 Console, Auxiliary, and vty Lines in the Running ConfigurationR1# R1# show running-config | section line line con 0 line aux 0 line vty 0 4 R1# Before we look at how to protect access to Cisco IOS EXEC modes, let’s take a look at the five different types of passwords available in Cisco IOS:
Type 4 passwords were deprecated in IOS 15.3(3). The type 4 password hash was weaker than the type 5 (MD5) hash. Therefore, type 4 passwords should never be used. IOS 15.3(3) introduced support for type 8 and type 9 passwords, and these password types should always be used when supported. Protection of Access to Cisco IOS EXEC ModesThis section looks at the steps you can take to secure both user and privileged EXEC modes. The first step in creating secure network device access is to protect the user EXEC mode by configuring passwords for local and remote CLI sessions. You start by entering line configuration mode by selecting the line number for the console port (for example, line console 0). Once you are in that mode, you use the password command to assign a password to line console 0. You use the login command at line console 0 to enable password checking at login. Next, let’s look at configuring a password for remote CLI sessions. After a password is configured for remote CLI sessions, the IOS device prompts for a password the next time you establish a remote CLI session with that device. Cisco IOS networking devices require that a password be configured for remote CLI sessions. If you attempt to start a remote CLI session with a device that does not have a password configured for remote CLI sessions, you get a message indicating that a password is required and that the password is not set. The remote CLI session will be terminated by the remote host. To configure a password for remote CLI sessions, you start by entering the line configuration mode and selecting the vty line (for example, line vty 0 4). When you are in that mode, you use the password command as you do for the console line. You use the login command at the vty line to enable password checking at login. Example 6.2 shows how to assign a password to the console, auxiliary, and vty lines and verify it in the running configuration. EXAMPLE 6.2 Configuring and Verifying Line PasswordsR1# R1# configure terminal Enter configuration commands, one per line. End with CNTL/Z. R1(config)# line con 0 R1(config-line)# password Cisco123 R1(config-line)# login R1(config-line)# line aux 0 R1(config-line)# password Cisco123 R1(config-line)# login R1(config-line)# line vty 0 4 R1(config-line)# password Cisco123 R1(config-line)# login R1(config-line)# end R1# R1# show running-config | section line line con 0 password Cisco123 login line aux 0 password Cisco123 login line vty 0 4 password Cisco123 login R1# The previous section covers protection of access to both local and remote CLI sessions in user EXEC mode using line passwords. Now let’s look at how to protect access to privileged EXEC mode. To add an additional layer of security, particularly for passwords that cross a network or that are stored with the configuration on a TFTP server, you can use the enable secret global configuration command. Cisco recommends the use of the enable secret command over the enable password command because it uses an improved encryption algorithm. When you configure the enable secret command, it takes precedence over the enable password command. The two commands cannot be in effect simultaneously. Let’s look at the use of the enable password command to configure a password for privileged EXEC mode. The password you enter with the enable password command is stored as plaintext in the device’s running configuration. You can encrypt the password for the enable password command in the configuration file of the networking device by using the service password-encryption command. However, the type 7 encryption level used by the service password-encryption command can be decrypted using tools available on the Internet, so it is not recommended for production deployments. The recommendation is to use the enable secret command because it provides strong encryption by hashing the password using type 5 passwords by default. However, on modern platforms, you can use type 8 or 9 passwords as well. You configure a password in privileged EXEC mode by using the command enable secret [level level] unencrypted-password | encryption-type encrypted-password. You can use the show privilege command to display the current level of privilege. Example 6.3 shows the configuration and verification of protection of privileged EXEC mode using the enable password command. Note in the verification that the password is stored in the running configuration in plaintext. This is because the default password, of type 0, was used. You can also set a type 7 password or set the EXEC level here. The command service password-encryption would make the password unreadable in the running configuration. EXAMPLE 6.3 Protecting Privileged EXEC with enable passwordR1# R1# configure terminal Enter configuration commands, one per line. End with CNTL/Z. R1(config)# enable password ? 0 Specifies an UNENCRYPTED password will follow 7 Specifies a HIDDEN password will follow LINE The UNENCRYPTED (cleartext) 'enable' password level Set exec level password Example 6.4 shows the configuration and verification of protection of privileged EXEC mode using the enable secret command. This provides stronger encryption and is the recommended method to use. This example uses type 9 encryption. When using type 9, you need to type in the encrypted password or use the algorithm-type command to hash a plaintext enable secret. Note that the verification output shows the encrypted type 9 password. EXAMPLE 6.4 Protecting Privileged EXEC with enable secretR1# R1# configure terminal Enter configuration commands, one per line. End with CNTL/Z. R1(config)# enable ? algorithm-type Algorithm to use for hashing the plaintext 'enable' secret password Assign the privileged level password (MAX of 25 characters) secret Assign the privileged level secret (MAX of 25 characters) After you have protected access to user EXEC mode and privileged EXEC mode by configuring passwords for them, you can further increase the level of security on the device by creating usernames. You configure usernames to limit access to CLI sessions to a networking device to specific users. This is especially important if you are configuring a device to allow first-line technical support user access. These users typically would not need to run all commands available in privileged EXEC mode. For example, suppose you want technical support staff to be able to view the configuration on a device that will help them to troubleshoot network problems without being able to modify the configuration. In this case, you can create a username, configure it with privilege level 15, and configure it to run the show running-config command automatically. When a user logs in with the username, the running configuration will be displayed automatically. There are three ways you can configure a username on a Cisco IOS device:
The last option provides the highest level of security since it allows for the highest level of password encryption (type 8 or type 9). If the final option is not supported on a network device, then the second option should be used since it provides MD5 encryption. The first option should be avoided because it configures a plaintext password. When you enable password authentication on a line by using the password command, you need to enable password checking. You do so by using the login command. This is what allows password use on the line. Once you have an alternate connection to the device, you can test the login. It is a good idea to have an alternate connection to a device if there is a problem logging in again using the line you made the changes on. The login local command allows for username/password pairs stored locally on the router to be used for the lines. By using the command login local, you can disable any password configured on lines. To enable username and password authentication on a line, you need to do the following configuration:
For remote CLI sessions, you can further protect the lines by using the transport input command. This command controls what protocols are allowed to access the vty lines. This can be configured with the command transport input {all | none |telnet | ssh}. The all option allows both Telnet and SSH access; none blocks Telnet and SSH; telnet allows only Telnet; and ssh allows only SSH access. Using telnet ssh allows both Telnet and SSH access. For the most secure access, the vty lines should be limited to SSH. Example 6.5 shows the configuration and verification of usernames. The user user1 is configured with a type 0 password, admin1 is configured with a type 9 password, tier1admin is configured with a type 9 password (scrypt in this case), and tier2admin is configured with a type 8 password (sha256 in this case). The login local command is configured under the vty lines to tell it to use the router local user account database for authentication. In this example, take note of the configured user accounts and the password types. user1 with the type 0 password is shown in running configuration in plaintext. Privilege level 15 gives access to all commands, such as the reload command, and allows a user to make configuration changes on the device. EXAMPLE 6.5 Configuring Usernames and PasswordsR1# R1# configure terminal Enter configuration commands, one per line. End with CNTL/Z. R1(config)# username user1 password weakpassword WARNING: Command has been added to the configuration using a type 0 password. However, type 0 passwords will soon be deprecated. Migrate to a supported password type R1(config)# username admin1 privilege 15 secret admin1secret R1(config)# username tier1admin algorithm-type scrypt secret tier1adminsecret R1(config)# username tier2admin algorithm-type sha256 secret tier2adminsecret R1(config)# line vty 0 4 R1(config-line)# login local R1(config-line)# end R1# R1# show running-config | include username username user1 password 0 weakpassword username admin1 privilege 15 secret 9 $9$iVS2wE3FxvTvDv$6k. NoCSCi2af4T8HpWeO1lBaTUnJzelT8S6xEETp7AI username tier1admin secret 9 $9$bIFEJkC8eW9Xyf$vXBZD.8ZSiHTcjpNVfuMWwX vveegKfHCfNXgLZUYA9w username tier2admin secret 8 $8$PLF4/9DTLkfoTf$820AEmeaZA2mNh2oNJjAYk6 bYKSlLhUn9pULnifodyo R1# Example 6.6 shows how to establish a Telnet session from R2 to R1 by using username-based authentication with the tier1admin username and type 9 password created earlier. You can see here that you can successfully connect and authenticate by using the tier1admin account. EXAMPLE 6.6 Verifying Username-Based Authentication for vty LinesR2# R2# telnet 100.1.1.1 Trying 100.1.1.1 ... Open Secured Access with SSHSSH is a far more secure option than Telnet. Although Telnet is the most popular protocol used to access Cisco IOS devices, it is an insecure protocol. Its session packets are carried in plaintext, making it easy for someone to sniff and capture session information as it traverses the network. SSH provides encryption for session traffic between a device and a terminal access application. This prevents others from being able to intercept and decode the traffic. SSH is available in two versions:
Let us now take a look at the steps that are needed to set up a Cisco IOS device to run SSH:
Those three steps are mandatory. After you have taken those steps, you may need to set SSH to Version 2 because it is at SSHv1 by default on some platforms. You do this with the ip ssh version 2 command. The other settings you can configure for the SSH service running on a device are the SSH timeout value and the authentication retries number. You do so with the command ip ssh timeout seconds authentication-retries number. Next, you set the transport input at the vty lines by using the transport input ssh command. Finally, also at the vty lines, you use the login local command to cause the local username and password on the router to be used for authentication. For verification, you can use the show ip ssh command to view the version and configuration information for the SSH server. We can also use the show ssh command to show the status of the SSH server. Example 6.7 demonstrates how to configure SSH, secure the vty lines to allow only SSH access, and verify connectivity from R2 to R1. EXAMPLE 6.7 Configuring and Verifying vty Access with SSHR1# R1# configure terminal Enter configuration commands, one per line. End with CNTL/Z. R1(config)# username admin2 secret Cisco123 R1(config)# ip domain-name cisco.com R1(config)# crypto key generate rsa The name for the keys will be: R1.cisco.com Choose the size of the key modulus in the range of 360 to 4096 for your General Purpose Keys. Choosing a key modulus greater than 512 may take a few minutes. Finally, you can set a timeout for EXEC sessions that are left idle, which may pose a security risk. Under the line confirmation mode, you can use the exec-timeout minutes seconds command to set the timeout. The default setting is 10 minutes. Using exec-timeout 0 0 and no exec-timeout disables the EXEC timeout. You should not use these commands this way in a production environment. The absolute-timeout minutes command in the line configuration mode sets the interval for closing the EXEC session after a specified time has elapsed. This session is closed even if it is being used at the time of termination. You can use the logout-warning seconds command with the absolute-timeout command to notify users of an impending logout. By default, the user is given 20 seconds’ notice before the session is terminated. Example 6.8 shows how to configure EXEC and absolute timeouts and logout warning. For line con 0, a timeout value of 4 minutes is configured. For the vty lines, a value of 3 minutes and 30 seconds is configured. For the vty lines, an absolute timeout of 10 minutes is configured, with a 120-second logout warning. EXAMPLE 6.8 Configuring EXEC and Absolute TimeoutsR1# R1# configure terminal Enter configuration commands, one per line. End with CNTL/Z. R1(config)# line con 0 R1(config-line)# exec-timeout 4 0 R1(config-line)# line vty 0 4 R1(config-line)# exec-timeout 3 30 !next we configure absolute timeout and logout warning R1(config-line)# absolute-timeout 10 !logout warning is configured in seconds R1(config-line)# logout-warning 120 R1(config-line)# end R1# Privilege Levels and Role-Based Access Control (RBAC)Now that we have examined the various ways of securing user and privileged EXEC modes, let’s take a look at the use of privilege levels and RBAC. By default, Cisco IOS devices have three privilege levels:
The commands that you can run in user EXEC mode at privilege level 1 are a subset of the commands that you can run in privileged EXEC mode at privilege 15. You can configure additional privilege levels from 2 through 14 to provide customized access control. For example, you might want to allow a group of technical support staff to configure only a specific set of interface-level commands on interfaces while preventing device-wide configuration privileges. You could configure this in global configuration mode by using the command privilege mode level level [command string]. After you create that technical support user and assign this privilege, the user will be allowed to enter the interface and execute the commands specified in the command string. You can verify the configuration with the show privilege command. Example 6.9 shows how to set up privileges to allow a network operation staff member to do basic manipulation of an interface. This example shows how to create the user user1noc with a type 9 password and privilege level 5 configured. In this particular case, a user with the user1noc username will be allowed to shut, unshut, and assign an IP address on the interface because these are the only commands this configuration allows in privilege level 5 in interface configuration mode. A user who tries to type a command that is not allowed (such as the description command) gets the message “Invalid input detected.” EXAMPLE 6.9 Configuring and Verifying a Username and a Privilege LevelR1# R1# configure terminal Enter configuration commands, one per line. End with CNTL/Z. R1(config)# username user1noc privilege 5 algorithm-type scrypt secret Cisco123 R1(config)# privilege exec level 5 configure terminal R1(config)# privilege configure level 5 interface R1(config)# privilege interface level 5 shutdown R1(config)# privilege interface level 5 no shutdown R1(config)# privilege interface level 5 ip address R1(config)# end R1# What is the service passwordservice password-encryption
This command obscures all clear-text passwords in the configuration using a Vigenere cipher. You enable this feature from global configuration mode. Now a show run command no longer displays the password in humanly readable format.
Why is it not necessary to use the enable password password command?So why don't we use the enable password command in most cases? The answer is simple: it's an outdated format that anyone can have ample opportunity to take advantage of.
Which of the following commands is used to secure privileged EXEC mode?There are two options available, the enable password and the enable secret. Both of these commands accomplish exactly the same thing. They allow you to configure a password that the user must enter, in order to access the Privileged EXEC Mode.
Which command is used for setting all password as encrypted in switch?With enable secret command, password is encrypted but is visible on the terminal when you type the password. To mask the password on the terminal, use the masked-secret global configuration command.
|