Secure Device Access

Flashcards on securing device access, covering topics like edge router security, password configuration, enhanced login security, and SSH configuration.

Edge Router

The last router between the internal network and an untrusted network, such as the internet.

Single Router

Connects the protected network to the internet, with all security policies configured on this device.

Defense-in-Depth

Employs multiple layers of security before traffic enters the protected LAN, typically including an edge router, firewall, and internal router.

DMZ

Area set up between two routers for servers that must be accessible from the internet.

Physical Router Security

Placing the router in a secure, locked room accessible only to authorized personnel, with UPS or diesel backup power.

Operating System Security

Upgrading the router to the maximum memory possible, using the latest stable OS version, and keeping secure backups of OS images and configuration files.

Router Hardening

Controlling access levels, disabling unused ports and interfaces, and disabling unnecessary services.

Local Access

The administrator must have physical access to the router and use a console cable to connect to the console port; typically used for initial configuration.

Remote Access

Involves allowing Telnet, SSH, HTTP, HTTPS, or SNMP connections to the router from a computer on the local or a remote network.

line console 0

Command used to enter line console configuration mode for securing user EXEC mode access.

password password

Command used to specify the user EXEC mode password.

login

Command used to enable user EXEC access.

enable secret password

Command used to secure privileged EXEC access.

line vty 0 15

Command used to enter line vty mode for securing vty lines.

service password-encryption

Command used to encrypt all plaintext passwords.

security passwords min-length length

Command used to ensure that all configured passwords are a minimum length.

login block-for seconds attempts number within seconds

Command used to deter brute-force password guessing attacks by blocking login attempts.

md5

Type 5, selects the message digest algorithm 5 (MD5) as the hashing algorithm.

scrypt

Type 9, selects scrypt as the hashing algorithm.

sha256

Type 8, selects Password-Based Key Derivation Function 2 (PBKDF2) with Secure Hash Algorithm, 256-bits (SHA-256) as the hashing algorithm.

Login Blocking

Detection profile that configures a network device to react to repeated failed login attempts by refusing further connection requests.

banner

Command used to specify appropriate messages; protects the organization from a legal perspective.

login block-for

Command that can defend against DoS attacks by disabling logins after a specified number of failed login attempts.

login quiet-mode

Command that maps to an ACL that identifies the permitted hosts.

login delay

Command that specifies the number of seconds the user must wait between unsuccessful login attempts.

login on-success and login on-failure

Commands that log successful and unsuccessful login attempts, respectively.

login on-success log and login on-failure log

Commands that generate syslog messages for successful and unsuccessful login attempts.

security authentication failure rate

Command that can be configured to generate a log message when the login failure rate is exceeded.

show login

Command used to verify the login block-for command settings and current mode.

show login failures

Command displays additional information regarding the failed attempts, such as the IP address from which the failed login attempts originated.

Enable SSH

Involves six steps: configure a unique device hostname, configure the IP domain name, generate a key to encrypt SSH traffic, verify or create a local database entry, authenticate against the local database, and enable vty inbound SSH sessions.

show ip ssh

Command used to verify the optional SSH command settings.

ip ssh time-out seconds

Command used to modify the default 120-second timeout interval for SSH authentication.

ip ssh authentication-retries integer

Command used to configure a different number of consecutive SSH retries before disconnection.

show ssh

Command used to verify the status of the client connections.