A network device has to be protected against unauthorised access. Cisco IOS gives you several entry points to secure: the console, privileged access and remote sessions.

The access points to protect

  • Console (con 0) — physical access through the console cable.
  • Enable — the step into privileged mode.
  • VTY (0 4) — remote Telnet or SSH sessions.

You set a password on each line, then encrypt the whole set so they do not appear in plain text in the configuration.

S1> enable
S1# configure terminal
S1(config)# enable secret Classe123
S1(config)# line console 0
S1(config-line)# password Cisco123
S1(config-line)# login
S1(config-line)# exit
S1(config)# line vty 0 4
S1(config-line)# password Cisco456
S1(config-line)# login
S1(config-line)# exit
S1(config)# service password-encryption

The enable secret command stores the privileged password in encrypted form (safer than enable password). The service password-encryption command hides the remaining passwords that would otherwise show in plain text. The login keyword turns on the password prompt for the line.

Key point: protect the console, enable and VTY, prefer enable secret and turn on service password-encryption. See Lab 6 – Basic access security.

PreviousNext