Device Access Lines and Local Users

What it is

Device access control decides who can log in to a router or switch, and what they can do once they are in.

An attacker who reaches the command line owns the device. The first defence is to control the lines, which are the console and the remote terminal lines, and to give each administrator a login. This page covers local authentication, where the device itself stores the users.

How it works

Lines accept the connections, and the local user database checks them.

The lines

On IOS XE the vty range depends on the platform, and many devices offer 0 to 15. Use show line to see which lines exist.

Local users and passwords

R1(config)# username ADMIN privilege 15 algorithm-type scrypt secret STRONGPASSWORD
R1(config)# enable algorithm-type scrypt secret ENABLEPASSWORD
R1(config)# service password-encryption

Use the secret keyword and not password. A secret is stored as a hash, and a password is stored in a form that is easy to reverse. The algorithm-type keyword picks the hash.

The command service password-encryption only hides plain text passwords with type 7, which is weak. It is not a real protection.

Securing the vty lines

R1(config)# ip domain name example.local
R1(config)# crypto key generate rsa modulus 2048
R1(config)# ip ssh version 2
R1(config)# access-list 10 permit 10.99.0.0 0.0.0.255
R1(config)# line vty 0 15
R1(config-line)# transport input ssh
R1(config-line)# login local
R1(config-line)# access-class 10 in
R1(config-line)# exec-timeout 5 0

Each part has a job.

• SSH keys: SSH needs a host name, a domain name and an RSA key pair.
• transport input ssh: allows SSH only, so Telnet is refused.
• login local: checks the local username database.
• access-class 10 in: limits which source addresses may connect.
• exec-timeout 5 0: logs out an idle session after 5 minutes and 0 seconds.

The console should be secured as well, with a login and a timeout.

R1(config)# line console 0
R1(config-line)# login local
R1(config-line)# exec-timeout 5 0
R1(config-line)# logging synchronous

The logging synchronous command stops log messages from breaking into what you type. It is a convenience, not a security feature.

Slowing down password guessing

R1(config)# login block-for 120 attempts 3 within 60

If three failed logins happen within 60 seconds, the device refuses further logins for 120 seconds. This slows an attacker who tries many passwords.

Privilege levels

IOS has privilege levels 0 to 15. Level 1 is user exec mode, and level 15 is full privileged access.

A user created with privilege 15 goes straight to privileged mode after logging in. Levels in between can be given a chosen set of commands, which is a simple way to give limited rights.

R1(config)# privilege exec level 5 show running-config

Verifying

R1# show users
R1# show ip ssh
R1# show line vty 0 15
R1# show running-config | section line vty

show users lists who is logged in and from where. show ip ssh shows whether SSH is on and which version runs. If SSH is not working, check the host name, the domain name and the RSA key, since the key is the most often forgotten part.

Limits of local authentication

Local users are simple and keep working even if the network or a server is down. They are hard to manage across many devices, because you must change each one by hand. A central AAA server fixes this, and it is covered in the next page.