Device Access Control with Local Passwords

What it is

Device access control protects the console, the vty lines and privileged mode with credentials stored on the device itself.

A router or switch with no password protection can be reconfigured by anyone who reaches it. This is the first line of defence.

On Cisco devices, you can protect three entry points with local credentials:

• the console line, the physical port
• the virtual terminal (vty) lines, used for remote logins
• privileged EXEC mode, entered with the enable command

"Local" means the passwords are stored on the device, rather than checked by a central server.

How it works

A user passes the line login, then the enable secret, before reaching configuration mode.

Console and vty lines

The console is the physical port for direct access. The vty lines accept remote Telnet or SSH sessions.

line console 0
 password CONSOLEPASS
 login
 exec-timeout 5 0
 logging synchronous
!
line vty 0 15
 password VTYPASS
 login
 transport input ssh
 exec-timeout 5 0

The password command sets the line password. The login command turns on the check. On the console line, a password has no effect until login is configured.

On the vty lines, login checking is normally on already, so a line with no password set refuses remote logins, and no login would let anyone in without a password. exec-timeout 5 0 logs out an idle session after 5 minutes and 0 seconds.

A line password is shared by everyone. A better method gives each administrator an individual account:

username admin secret STRONGPASS
line vty 0 15
 login local
 transport input ssh

login local makes the line check the local username database. Each person has a name, so you know who logged in, and you can remove one account without changing the others.

Protecting privileged mode

After logging in, a user lands in user EXEC mode with limited commands. The enable command moves to privileged EXEC mode, which can change the configuration. It should be protected as well.

enable secret ENABLEPASS

There are two commands, and they are not equal:

If both enable password and enable secret are set, the secret takes priority. enable secret stores a hash, not the password itself.

The hash type depends on the platform and software. The older method is MD5 (type 5), and newer ones use stronger algorithms, such as type 8 (PBKDF2 with SHA-256) and type 9 (scrypt). You pick them with the algorithm-type keyword, as in enable algorithm-type scrypt secret PASSWORD.

service password-encryption applies a simple reversible scrambling (type 7) to passwords that would otherwise appear in plain text, such as line passwords. It only stops a casual glance at the configuration.

Tools to reverse it are widely available. It is not real encryption, so do not rely on it. For local users, username NAME secret is better than username NAME password, because it uses a hash.

Extra protections

security passwords min-length 10
login block-for 120 attempts 3 within 60
banner motd # Authorised access only #

• security passwords min-length 10 rejects passwords shorter than 10 characters.
• login block-for 120 attempts 3 within 60 blocks further logins for 120 seconds after 3 failed attempts within 60 seconds. This slows down password guessing.
• A banner displays a legal warning before login. It should say that access is for authorised users only. It should not say "welcome".

On the vty lines, transport input ssh makes sure that only SSH is accepted, so passwords do not cross the network in clear text. SSH itself is covered in the IP Services chapter.

Verifying

show running-config | section line
show running-config | include enable
show users
show login

The first command shows the line settings. show users lists who is logged in, and show login shows whether login blocking is active.

To test, open a new session and confirm that a password is requested. Keep the existing session open while you test, so that a mistake does not lock you out.