Device Security Configuration - Lab Exercise
Device Security Configuration - Lab Exercise
In this lab you will secure administrative access to the Cisco router in a small campus network.
Lab Topology:
Secure Privileged Exec Mode
1) Set the enable password Duytan2 on R1 to secure access to Privileged Exec (Enable) mode.
R1(config)#enable password Duytan2
2) Exit to User Exec mode.
R1#exit
3) Enter Privileged Exec mode.
R1>enable
Password:Duytan2
R1#
4) Set the enable secret Duytan1.
R1(config)#enable secret Duytan1
5) Exit to User Exec mode.
R1#exit
6) Do you expect to be able to enter Privileged Exec mode using the password Duytan2? Why or why not? Verify this.
You cannot enter Privileged Exec mode using the enable password because it has been superseded by the enable secret.
R1>enable
Password:Duytan2
Password:Duytan1
R1#
7) Show the running configuration on R1. Can you read the enable password and secret in plain text?
The enable password is shown in plain text but the enable secret is encrypted.
R1#show run
Building configuration...
Current configuration : 762 bytes
!
version 15.1
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname R1
!
enable secret 5 $1$mERr$J2XZHMOgpVVXdLjC9lYtE1
enable password Duytan2
8) Ensure that passwords will not show in plain text in the output of ‘show’ commands.
R1(config)#service password-encryption
9) Verify the enable password is now encrypted when you show the running configuration.
R1#show running-config
Building configuration...
Current configuration : 772 bytes
!
version 15.1
no service timestamps log datetime msec
no service timestamps debug datetime msec
service password-encryption
!
hostname R1
!
enable secret 5 $1$mERr$J2XZHMOgpVVXdLjC9lYtE1
enable password 7 0807404F0A1207180A59
Secure Remote Telnet and SSH Access
10) Enable synchronous logging on R1 and ensure administrators are logged out after 15 minutes of activity on the console and virtual terminal lines 0-15.
R1(config)#line console 0
R1(config-line)#logging synchronous
R1(config-line)#exec-timeout 15
R1(config)#exit
R1(config)#line vty 0 15
R1(config-line)#logging synchronous
R1(config-line)#exec-timeout 15
R1(config)#exit
11) Allow the administrator workstation at 10.0.0.10 to Telnet into R1 using the password Duytan3. Ensure no other host has Telnet access to the router.
R1(config)#access-list 1 permit host 10.0.0.10
R1(config)#line vty 0 15
R1(config-line)#login
R1(config-line)#password Duytan3
R1(config-line)#access-class 1 in
12) Ensure that users attempting to Telnet into the router see the message “Authorised users only”
R1(config)#banner login "
Enter TEXT message. End with the character '"'.
Authorised users only"
13) Verify you can Telnet into R1 from PC1 and enter Privileged Exec mode. Close the Telnet session when done.
C:\> telnet 10.0.0.1
Trying 10.0.0.1 … Open
Authorised users only
User Access Verification
Password: Duytan3
R1>enable
Password: Duytan1
R1#exit
[Connection to 10.0.0.1 closed by foreign host]
14) Verify Telnet access fails from PC2.
C:\> telnet 10.0.0.1
Trying 10.0.0.1 …
% Connection refused by remote host
15) Configure R1 so that administrators will be prompted to enter a username and password when they attempt to Telnet into the router. Use username admin and password Duytan4.
R1(config)#username admin secret Duytan4
R1(config)#line vty 0 15
R1(config-line)#login local
16) Verify you are prompted for a username and password when you attempt to Telnet to the router.
C:\> telnet 10.0.0.1
Trying 10.0.0.1 …Open
Authorised users only
User Access Verification
Username: admin
Password: Duytan4
R1>exit
[Connection to 10.0.0.1 closed by foreign host]
17) Allow the administrator workstation at 10.0.0.10 to SSH into R1. Use the domain name duytan.com and a 768 bit key.
R1(config)#ip domain-name duytan.com
R1(config)#crypto key generate rsa
The name for the keys will be: R1.duytan.com
Choose the size of the key modulus in the range of 360 to
2048 for your General Purpose Keys. Choosing a key modulus greater than 512 may take a few minutes.
How many bits in the modulus [512]: 768
% Generating 768 bit RSA keys, keys will be non-exportable...[OK]
18) Verify you can SSH into R1 from PC1. Close the session when done.
C:\> ssh –l admin 10.0.0.1
Open
Password: Duytan4
R1>exit
[Connection to 10.0.0.1 closed by foreign host]
19) Do you expect to be able to SSH to R1 from PC2? Why or why not? Verify this.
You will not be able to SSH to R1 from PC2. Telnet and SSH access are both controlled by the ‘line vty’ configuration which has an access list applied only allowing access from PC1.
C:\> ssh –l admin 10.0.0.1
Trying 10.0.0.1 …
% Connection refused by remote host
20) You can currently access R1 using either Telnet or SSH. Telnet is an insecure protocol as all communication is sent in plain text. Configure R1 so that only SSHv2 remote access is allowed.
R1(config)#line vty 0 15
R1(config-line)#transport input ssh
R1(config-line)#exit
R1(config)#ip ssh version 2
21) Verify you cannot Telnet into R1 from PC1 but can SSH. Exit when done.
C:\> telnet 10.0.0.1
Trying 10.0.0.1 …Open
[Connection to 10.0.0.1 closed by remote host]
C:\> ssh –l admin 10.0.0.1
Open
Password: Duytan4
R1>exit
[Connection to 10.0.0.1 closed by foreign host]
22) What username and password do you need to use to login when you connect directly to R1 with a console cable?
No username and password are currently required to login to the console. The virtual terminal lines which control Telnet and SSH access have been secured but console access has not.
23) Configure R1 to require no username but a password of Duytan5 to login over the console connection.
R1(config)#line console 0
R1(config-line)#login
% Login disabled on line 0, until 'password' is set
R1(config-line)#password Duytan5
24) Verify you can access R1 over the console connection and enter Privileged Exec mode.
R1(config-line)#end
R1#logout
R1 con0 is now available
Press RETURN to get started.
Authorised users only
User Access Verification
Password: Duytan5
R1>enable
Password: Duytan1
R1#
NTP Network Time Protocol
25) Configure R1 to synchronise its time with the NTP server at 10.0.1.100. Set the timezone as Pacific Standard Time which is 8 hours before UTC.
R1(config)#clock timezone PST -8
R1(config)#ntp server 10.0.1.100
26) Check the current time on the router and verify it is synchronised with the NTP server.
R1#show clock
16:19:36.51 PST Mon Oct 2 2017
R1#show ntp status
Clock is synchronized, stratum 2, reference is 10.0.1.100
nominal freq is 250.0000 Hz, actual freq is 249.9990 Hz,
precision is 2**19
reference time is DD53255C.0000039C (00:16:28.924 UTC Tue
Oct 3 2017)
clock offset is 0.00 msec, root delay is 0.00 msec
root dispersion is 0.02 msec, peer dispersion is 0.02 msec.
Switch Management
27) Configure SW2 with IP address 10.0.1.50 for management on VLAN 1. Ensure the switch has connectivity to other IP subnets.
(Note that it is best practice to NOT use VLAN 1 for any production traffic in a real world network and we would normally have a separate dedicated IP subnet for management traffic. We are using VLAN 1 in our lab environment to simplify the topology).
SW2(config)#int vlan 1
SW2(config-if)#ip address 10.0.1.50 255.255.255.0
SW2(config-if)#no shutdown
SW2(config-if)#exit
SW2(config)#ip default-gateway 10.0.1.1