Configuring Security

Nonprivileged Mode Password

line console 0
login
password: 1forALL
 

When you log in to the system, the system login prompt is as follows:

User Access Verification
Password:

You must enter the password 1forAll to gain nonprivileged access to the system. The system response is as follows:

router>

Nonprivileged mode is signified on the system by the > prompt. At this point, you can enter a variety of commands to view statistics on the system, but you cannot change the configuration of the system. Never use cisco, or other obvious derivatives, such as pancho, for a Cisco system password. These will be the first passwords intruders will try if they recognize the Cisco login prompt.

enable-password san-fran

To access privileged mode, enter the following command:

router> enable

Password:password

Enter the password san-fran to gain privileged access to the system. The system responds as follows:

router#

Privileged mode is signified by the # prompt. In privileged mode, you can enter all commands to view statistics and configure the system.

line console 0
exec-timeout 1 30

line vty 0 4
login
password: marin

When a user telnets to a system IP address, the system provides a prompt similar to the following:

% telnet router
Trying ...
Connected to router.
Escape character is '^]'.
User Access Verification
Password:

If the user enters the correct nonprivileged password, the following prompt appears:

router>

Privileged Mode Password

The Internet community, recognizing this problem, greatly enhanced the security of SNMP version 2 (SNMPv2) as described in RFC 1446. SNMPv2 uses an algorithm called MD5 to authenticate communications between an SNMP server and agent. MD5 verifies the integrity of the communications, authenticates the origin, and checks for timeliness. Further, SNMPv2 can use the data encryption standard (DES) for encrypting information.

Note   For detailed SNMP information and the supported MIBs, refer to chapter 2, System Monitoring, of the Cisco ICS 7750 Administration and Troubleshooting Guide.

Nonprivileged Mode

snmp-server community public RO 1

You can also specify a list of IP addresses that are allowed to send messages to the system using the access-list option with the snmp-server community command. In the following configuration example, only hosts 1.1.1.1 and 2.2.2.2 are allowed nonprivileged mode SNMP access to the system:

access-list 1 permit 1.1.1.1
access-list 1 permit 2.2.2.2
snmp-server community public RO 1

Privileged Mode

Use the RW keyword of the snmp-server community command to provide privileged access to your systems through SNMP. The following configuration command sets the agent in the system to allow only SNMP set-request messages sent with the community string private:

snmp-server community private RW 1

You can also specify a list of IP addresses that are allowed to send messages to the system by using the access-list option of the snmp-server community command. In the following configuration example, only hosts 5.5.5.5 and 6.6.6.6 are allowed privileged mode SNMP access to the system:

access-list 1 permit 5.5.5.5
access-list 1 permit 6.6.6.6
snmp-server community private RW 1

TACACS+ provides for separate and modular authentication, authorization, and accounting facilities. TACACS+ allows for a single access control server (the TACACS+ daemon) to provide each service—authentication, authorization, and accounting independently. Each service can have access to its own database to take advantage of other services available on that server or on the network, depending on the capabilities of the daemon.

The goal of TACACS+ is to provide a methodology for managing multiple network access points from a single management service. The Cisco family of access servers and systems and the Cisco IOS user interface (for both systems and access servers) can be network access servers.

• Authentication—provides complete control of authentication through login and password dialog, challenge and response, messaging support. The authentication facility provides the ability to conduct an arbitrary dialog with the user (for example, after a login and password are provided, to challenge a user with a number of questions like home address, mother's maiden name, service type, and social security number). In addition, the TACACS+ authentication service supports sending messages to user screens. For example, a message could notify users that their passwords must be changed because of the company's password aging policy.

• Authorization—provides fine-grained control over user capabilities for the duration of the user's session, including but not limited to setting auto commands, access control, session duration, or protocol support. You can also enforce restrictions on the commands a user may execute with the TACACS+ authorization feature.

• Accounting—collects and sends information used for billing, auditing, and reporting to the TACACS+ daemon. Network managers can use the accounting facility to track user activity for a security audit or to provide information for user billing. Accounting records include user identities, start and stop times, executed commands (such as PPP), number of packets, and number of bytes.

The TACACS+ protocol provides authentication between the network access server and the TACACS+ daemon, and it ensures confidentiality because all protocol exchanges between a network access server and a TACACS+ daemon are encrypted.

You need a system running TACACS+ daemon software to use the TACACS+ functionality on your network access server.

Cisco makes the TACACS+ protocol specification available as a draft RFC for those customers interested in developing their own TACACS+ software.

TACACS+ Configuration Task List

Firewalls are often placed in between the internal network and an external network such as the Internet. With a firewall between your network and the Internet, all traffic coming from the Internet must pass through the firewall before entering your network.

Firewalls can also be used to control access to a specific part of your network. For example, you can position firewalls at all the entry points into a research and development network to prevent unauthorized access to proprietary information.

The most basic function of a firewall is to monitor and filter traffic. Firewalls can be simple or elaborate, depending on your network requirements. Simple firewalls are usually easier to configure and manage. However, you might require the flexibility of a more elaborate firewall.

Cisco provides basic traffic filtering capabilities with access control lists (also referred to as access lists). You can configure access lists at your system to control access to a network: access lists can prevent certain traffic from entering or exiting a network.Access lists can be configured for all routed network protocols (IP, AppleTalk, and so on) to filter those protocols' packets as they pass through a system.

What Access Lists Do

Access lists filter network traffic by controlling whether routed packets are forwarded or blocked at the system's interfaces. Your system examines each packet to determine whether to forward or drop the packet, based on the criteria you specified within the access lists.

Access list criteria could be the source address of the traffic, the destination address of the traffic, the upper-layer protocol, or other information. Note that sophisticated users can sometimes successfully evade or fool basic access lists because no authentication is required.

When to Configure Access Lists

Access lists should be used in firewall systems, which are often positioned between your internal network and an external network such as the Internet. You can also use access lists on a system positioned between two parts of your network to control traffic entering or exiting a specific part of your internal network.

To provide the security benefits of access lists, you should at a minimum configure access lists on border systems—systems at the edges of your networks. This provides a basic buffer from the outside network, or from a less-controlled area of your own network into a more sensitive area of your network.

Overview of Access List Configuration

Although each protocol has its own set of specific tasks and rules required in order for you to provide traffic filtering, most protocols require at least two basic steps to be accomplished:

• Create an access list definition

  Create access lists for each protocol you wish to filter, per system interface. For some protocols, you create one access list to filter inbound traffic and one access list to filter outbound traffic.

  To create an access list, you specify the protocol to filter, you assign a unique name or number to the access list, and you define packet filtering criteria. A single access list can have multiple filtering criteria statements.

  Cisco recommends that you create your access lists on a TFTP server then download the access lists to your system. This can considerably simplify maintenance of your access lists.

• Apply the access list to an interface.

  For some protocols, you can apply up to two access lists to an interface: one inbound and one outbound. With other protocols, you apply only one access list that checks both inbound and outbound packets.

  If the access list is inbound, when the system receives a packet, the Cisco IOS software checks the access list's criteria statements for a match. If the packet is permitted, the software continues to process the packet. If the packet is denied, the software discards the packet.

  If the access list is outbound, after receiving and routing a packet to the outbound interface, the software checks the access list's criteria statements for a match. If the packet is permitted, the software transmits the packet. If the packet is denied, the software discards the packet.

Note that some protocols refer to access lists as filters and refer to the act of applying the access lists to interfaces as filtering.

The guidelines discussed in this section apply in general to all protocols. The specific instructions for creating access lists and applying them to interfaces vary from protocol to protocol, and that specific information is not included in this section.

Note   The complete configuration and command information to configure access lists is available through CCO by selecting Service and Support > Technical Documents > Documentation Home Page > Cisco IOS Software Configuration > Cisco IOS Release 12.0 > Configuration Guides and Command References. To configure access lists for a specific protocol see the protocol's chapter in the appropriate configuration guide. For example, to configure access lists for the IP protocol, refer to the Configuring IP Services chapter in the Network Protocols Configuration Guide, Part 1.

RADIUS is a fully open protocol, distributed in source code format, that can be modified to work with any security system currently available on the market.

Cisco supports RADIUS under its authentication, authorization, and accounting (AAA) security paradigm. RADIUS can be used with other AAA security protocols, such as TACACS+, Kerberos, or local username lookup. RADIUS is supported on all Cisco platforms.

RADIUS has been implemented in a variety of network environments that require high levels of security while maintaining network access for remote users.

RADIUS Configuration Task List

• Use the aaa new-model global configuration command to enable AAA. AAA must be configured if you plan to use RADIUS.

• Use the aaa authentication global configuration command to define method lists for RADIUS authentication.

• Use line and interface commands to enable the defined method lists to be used.

The following configuration tasks are optional:

• If needed, use the aaa authorization global command to authorize specific user functions.

• If needed, use the aaa accounting command to enable accounting for RADIUS connections.

RADIUS Authentication, Authorization, and Accounting Example

The following example is a general configuration using RADIUS with the AAA command set entered in global configuration mode:

radius-server host 123.45.1.2
radius-server key myRaDiUSpassWoRd
username root password ALongPassword
aaa authentication ppp dialins radius local
aaa authorization network radius local
aaa accounting network start-stop radius
aaa authentication login admins local
aaa authorization exec local
line 1 16
autoselect ppp
autoselect during-login
login authentication admins
modem ri-is-cd
interface group-async 1
encaps ppp
ppp authentication pap dialins
 

The lines in this example RADIUS authentication, authorization, and accounting configuration are defined as follows: