Setting Up Usernames
If you don't have access to TACACS+ or RADIUS, local usernames can be configured on a system as fol
Router(config)#username username password password Router(config)#line vty 0 4 Router(config-line)#login local
The preceding commands set up a local username and password and then configure the vty lines to use database.
To configure TACACS+ access to a system, you must first enable the AAA system:
Router(config)#aaa new-model
You then must define the TACACS+ host and password:
Router(config)#tacacs-server host ipaddr Router(config)#tacacs-server key password
After setting up the host, you must define the authentication methods. The following uses TACACS+ as default authentication but also defines an authentication method no-tacacs, which can be used for the port. Using AAA for the console port is not recommended because if the network is down, you won't be . log on to the box.
Router(config)#aaa authentication login default group tacacs+ Router(config)#aaa authentication login no-tacacs line
The line parameters can then be modified based on which method you want to use to authenticate:
Router(config)#line vty 0 4
Router(config-line)#login authentication default
Router(config)#line con 0
Router(config-line)#login authentication no-tacacs
So far, these AAA commands have dealt only with authentication. Say, for example, you wanted to hav< detailed log of every command typed on a router as well as when an administrator logged in or out. The commands enable TACACS+ accounting for these events:
! Enable login and logout tracking for router administrators Router(config)#aaa accounting exec default start-stop group tacacs+ ! Enable command logging for exec level 1 commands (basic telnet) Router(config)# aaa accounting commands 1 default start-stop group tacacs+ ! Enable command logging for exec level 15 commands (enable mode) Router(config)# aaa accounting commands 15 default start-stop group tacacs+
AAA can be very complicated. You have lots of options at your disposal. For more information about con AAA on Cisco devices, see the following site:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fsecur c/fsaaa/index.htm. Secure Shell (SSH)
Use SSH instead of Telnet whenever possible. To configure it, you must first define a hostname, domain and generate keys:
Router(config)#hostname hostname Router(config)#ip domain-name yourdomain.com Router(config)#crypto key generate rsa
From here, you can refer to the transport input command in the "Line Access" section earlier in this cl set up the vty lines to accept only SSH, enter the following command:
Router(config)#line vty 0 4 Router(config)#transport input ssh
There are a few other options with respect to SSH configuration. See the following URL if you'd like mor information:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fsecur c/fothersf/scfssh.ht
Continue reading here: Other Hardening Options
Was this article helpful?