Enables password checking at login for vty Telnet sessions
Boston(config)# line vty 0 4 Boston(config-line)# login Boston(config-line)# password
CantGessMeVTY
Cisco routers support multiple Telnet sessions (up to five simultaneous sessions by default, and more can be added), each serviced by a logical vty line. By default, Cisco routers do not have any line-level passwords configured for these vty lines. If you enable password checking, you must also configure a vty password before attempting to access the router using Telnet. If you fail to configure a vty password and password checking is enabled for the vty lines, you will encounter an error message similar to this message:
Telnet 10.0.1.2
Password required, but none set
[Connection to 10.0.1.2 closed by foreign host]
There are two ways to configure a vty password. The first way is to enter the password during the initial configuration dialog. The second way is by using the password command in vty configuration mode, as shown in the figure. Always configure passwords for all of the vty ports in this manner.
In the example shown in the figure, vty 0 4 (logical vty 1 to vty 5) are configured simultaneously to look for the password specified. Just like console line-level passwords, vty passwords are, by default, shown as clear text (unencrypted) in the router configuration.
2-32 Securing Cisco Network Devices (SND) v2.0 © 2006 Cisco Systems, Inc.
Here are things to consider when securing Telnet connections to a Cisco router:
■ If you fail to set an enable password for the router, you will not be able to access privileged EXEC mode using Telnet. Use either the enable password or enable secret password command to set the enable password for your routers.
■ Telnet access should be limited only to specified systems by building a simple access control list (ACL) that does the following:
— Allows Telnet access from specific hosts only (allows certain IP addresses)
— Blocks Telnet access from specific untrusted hosts (disallows certain IP addresses)
— Ties the ACL to the vty lines using the access-class command
Here is an example showing ACL 30 restricting Telnet access only from host 10.0.1.1 and denying access from any other hosts (implicit deny) for vty 0 to 4:
Boston(config)# access-list 30 permit 10.0.1.1
Boston(config)# line vty 0 4 Boston(config-line)# access-class 30 in
■ You must configure passwords for each vty on the router. Remember that you can add more vtys to the router, and these lines and the default 0 to 4 lines must be protected.
© 2006 Cisco Systems, Inc. Securing the Perimeter 2-33
Continue reading here: Setting a Login Failure Rate
Was this article helpful?