Password Usage
I have been teaching Cisco-related courses, including official Cisco classes, for more than 7 years. In almost all courses, I see Cisco using the passwords of cisco, san-fran or sanfran, and san-jose or sanjose as examples to secure user and privileged EXEC levels of access. You would think that something as obvious as these passwords never would be used in a production environment, but many times I have seen these used as passwords to secure company routers. Basically, the newbie Cisco IOS administrator looked at the examples in Cisco's course material and copied them verbatim. Guess what passwords a hacker first will try when gaining access to your router?
Login Authentication Methods
One main difference between the console line for user EXEC access and the auxiliary and VTY (discussed in the next section) lines is that a password on the console line is optional, whereas it is required on auxiliary and VTY lines. You must enable authentication on these two latter types of lines to allow access. If you do not, the Cisco IOS displays an error message and closes the connection:
Password required, but none set
[Connection to 192.168.1.254 closed by foreign host]
This document was created by an unregistered ChmMagic, please go to http://www.bisenter.com to register it. Thanks To allow access through the auxiliary or VTY lines, use one of the following two configurations:
Router(config)# line aux 0 Router(config-line)# [no] login [local]
Router(config)# line vty 0 4 Router(config-line)# [no] login [local]
The login command, by itself, specifies the use of authentication. By default, it checks for a password configured with thpassword line-configuration command. If this does not exist, the user is not allowed access. To disable authentication checking, use the no login command. Note that this never is recommended for any type of connection, whether local or remote access.
NOTE
Even if the Cisco IOS does not check a password for user EXEC access, a password still must be configured for privileged EXEC access for remote-access connections. Otherwise, the user is not allowed access to user and privileged EXEC mode. This process is not true concerning the console line.
Optionally, you can override the use of the password configured on the line and use other methods, such as a local username and password database, by specifying login local (discussed later in this chapter in the Local Authentication Database" section), or use external authentication using a security server (discussed in Chapter 5). Remember my earlier caution: Use either of these two methods (preferably the latter one, which is preferred for securing line access).
Always put some method of authentication on all your lines, even ones that you are not using, such as the auxiliary line.
This ensures that later someone does not set up a new line connection inadvertently and forget to secure it.
Login Connection Timeouts
By default, console, auxiliary, and Telnet (VTY) sessions time out after 10 minutes of idling. You can override this with the exec-timeout command, shown here:
Router(config)# line type #
Router(config-line)# exec-timeout minutes seconds
You must specify the minutes and seconds for the timeout. Optionally, you can specify 0 and 0 for the minutes and seconds, specifying an infinite timeout. I never recommend this for a production router, but only for lab situations, such as practicing for the CCIE Router and Switch or Security lab exam.
This simple example sets the timeout to 5 minutes for Telnet sessions:
Router(config)# line vty 0 4 Router(config-line)# exec-timeout 5 0
To view your timeouts, use the show line command. Based on my previous configuration. Example 3-1 shows the partial output of this command.
Example 3-1. Example Line Configuration
Router# show line vty 0
Tty Typ Tx/Rx A Modem Roty AccO Accl Uses Noise Overruns Int 6 VTY 2 0 0/0
Line 6, Location:"", Type:"" Length: 24 lines, Width: 80 columns Baud rate (TX/RX) is 9600/9600 Status: Ready, No Exit Banner Capabilities: none Modem state: Ready
Special Chars: Escape Hold Stop Start Disconnect Activation AAx none - - none
Timeouts: Idle EXEC Idle Session Modem Answer Session Dispatch 00:05:00 never none not set
Idle Session Disconnect Warning never
Login-sequence User Response 00:00:30
Autoselect Initial Wait not set output omitted
In Example 3-1. you can see that the idle timeout, below the Idle EXEC column, was set to 5 minutes. This is a common setting for Telnet sessions.
Was this article helpful?