Securing access to Cisco network devices

When you power on a Cisco router or switch for the first time, it has very little built-in access control. For example, if you have console access, you can typically type enable and press Enter to move straight into Privileged EXEC mode. That’s a problem: anyone with physical access to the device (and a rollover cable) could gain full access to the configuration.

This chapter covers basic features that make it harder to log in to a Cisco IOS device without authorization.

The “enable” password

You can require a password before a user can enter Privileged EXEC mode. This is an important first line of defense, especially against someone who can reach the console port.

Here’s the default behavior:

• You start in User EXEC mode.
• Typing enable takes you into Privileged EXEC mode.
• From there, you can view the running configuration and enter Global Configuration mode to add, remove, or change settings.

If you configure an enable password, the device prompts for that password before allowing access to Privileged EXEC mode.

To configure it, enter Global Configuration mode (which requires Privileged EXEC access) and use:

enable password [password]

• enable password is the command.
• Replace [password] with the password you want users to enter.

After you exit back out of the session (for example, by using exit from User EXEC mode), the next person who types enable will see a password prompt.

Image

Image Title - User entering the enable password to enter Privileged mode

This helps, but it introduces another risk: the password can appear in the running configuration.

Imagine you’re viewing the running configuration on a critical router and someone nearby can see your screen. They might see something like this:

Image

Image Title - Enable password displayed in the clear in the running configuration

The problem is that the enable password (for example, password123) is visible to anyone who can see the screen. This is a classic shoulder surfing scenario: someone quietly observes sensitive information without your knowledge.

So how do you reduce the chance of passwords being exposed in the configuration output?

Securing passwords on Cisco devices

One way to reduce password exposure is to enable Service Password Encryption. This feature “scrambles” passwords that appear in the running configuration by converting them into a hexadecimal-looking string.

A few key terms help here:

• Hash: the output produced when an algorithm transforms the original password into a fixed-looking string.
• Cisco IOS uses the Message-Digest 5 Algorithm (MD5) for this feature.

To enable Service Password Encryption, go to Global Configuration mode and enter:

service password-encryption

Now, if you look at the part of the running configuration where the enable password appears, you’ll see something like this:

Image

Image Title - Enable password now displayed with encryption in the running configuration

Instead of showing the original password (“password123”), the configuration shows a string such as 08314D5D1A0E0A05165A5E57. That’s harder to copy quickly during a shoulder surfing attempt, and it’s not the original password.

However, this approach has a major limitation. MD5-based password obfuscation has been considered weak for many years. Attackers can often take the displayed value and run it through readily available tools to recover the original password.

In other words, standard MD5-based scrambling can create a false sense of security: it may slow someone down, but it doesn’t reliably protect the password if the attacker can capture the hashed value.

MD5 Hashed passwords on a Cisco device are called Type 7 “veneer” passwords. They give the appearance of security and can slow an attacker down, from discovering the true password however, they are not difficult to decipher.

Better security for Cisco passwords

Service Password Encryption may slow down an attacker, but it’s not strong protection by modern standards.

A stronger option is to use “salted” MD5 encryption. With salting, the device adds a unique random value (the salt) to the password before hashing it. This makes the resulting hash much harder to reverse.

Cisco refers to this stronger method as Type 5 encryption.

To protect the enable password using Type 5, configure an enable secret in Global Configuration mode:

enable secret [password]

• enable secret replaces enable password.
• The device stores the password using the stronger salted MD5 hash.

Here’s what it looks like in the running configuration when you use the same example password (password123) with enable secret:

Image

Image Title - Enable password displayed with Type 5 encryption in the running configuration

Type 5 passwords will be displayed with the encrypted string in the running configuration regardless of whether Service Password Encryption is enabled on the Router or not.

Securing local user passwords

An enable password (or enable secret) controls access to Privileged EXEC mode, but you’ll often want individual user accounts as well.

This is useful when different people need different levels of access:

• Basic users might only need to run a limited set of show commands in User EXEC mode. These users typically use the default privilege level 1.
• Network administrators may need full access to view configurations and make changes. These users typically use privilege level 15.

A user with privilege level 15, also does not have to enter the “enable” password. They are able to jump directly into Privilege EXEC mode.

Configuring a local user account with an encrypted password

In Chapter 7.1 Remote access to network devices using Telnet and Secure Shell (SSH), we configured a local user account for remote login.

If you use the password keyword, the device stores the password in a way that can appear in clear text in the running configuration:

username admin privilege 15 password cisco

It is important to note however, if you have Service Password Encryption enabled on the Router, it would definitely store the password in the running configuration with encryption, using a simple Type 7 MD5 Hash. It would not be the most secure, but it would at least slow down Shoulder Surfing attacks and buy you time to use a more secure method of storing the password.

For stronger protection, configure the user with the secret keyword instead:

username admin privilege 15 secret cisco

Using the keyword secret instead of “password” causes the router to store the password using a much stronger encryption method, which better protects it from being learned by someone who can view the configuration.

Image

Image Title - Configuring a local user account with a Type 5 encrypted password

It is important to note that in order to have the router actually use the local user account that is configured on the router, you must go underneath the VTY line sub-configuration mode and enter the login local command. For example:

line vty 0 15 login local

Otherwise, the router will not allow you to authenticate using SSH, since no authentication method has been set.

Sidenote

Line VTY passwords

Instead of configuring local user accounts for remote access, you can configure a password directly on the VTY lines to authenticate remote users. You would configure:

line vty 0 15
login
password [the desired password]

Use the “login” keyword under the VTY lines (not “login local”, which is used with local user accounts). This method is not recommended. If you do use it, enable Service Password Encryption so the password isn’t displayed in clear text in the configuration. As a best practice, use unique user accounts with the Type 5 secret method instead.

In practice, you’ll often use these together:

• service password-encryption
• enable secret
• Local usernames configured with secret

That combination provides a solid baseline, although there are additional best practices for securing Cisco devices that are outside the scope of the CCNA 200-301 v1.1 exam.