Security
Device Hardening and Secure Remote Access
Basic device security includes securing local and remote access lines, encrypting passwords, and configuring SSH as a secure replacement for Telnet.
What you need to know
- SSH requires a hostname, a domain name (ip domain-name), and an RSA key pair (crypto key generate rsa) before it can be enabled.
- transport input ssh on the vty lines disables Telnet and allows only SSH; transport input telnet ssh allows both.
- service password-encryption applies weak type 7 encryption to plaintext passwords in the configuration.
- enable secret uses a stronger MD5 (or newer) hash and always takes precedence over enable password.
- login local on vty/console lines requires a local username/password database instead of a single shared line password.
- SSH version 2 is recommended over version 1 due to known vulnerabilities; set with ip ssh version 2.
- Console and vty lines should have both a password/login method and an exec-timeout to reduce exposure from unattended sessions.
Configuration commands
| Command | Mode | Purpose |
|---|---|---|
| hostname R1 | config | Set the device hostname, required as part of the SSH key domain identity. |
| ip domain-name lab.local | config | Set the domain name, required before generating an RSA key. |
| crypto key generate rsa modulus 2048 | config | Generate the RSA key pair used by SSH. |
| username admin secret Cisco123! | config | Create a local user account with a hashed secret for login local. |
| ip ssh version 2 | config | Restrict SSH to version 2 only. |
| line vty 0 4 | config | Enter configuration for the vty lines used for remote access. |
| transport input ssh | config-line | Allow only SSH on the vty lines, disabling Telnet. |
| login local | config-line | Require login using the local username database. |
| exec-timeout 5 0 | config-line | Disconnect idle sessions after 5 minutes. |
| enable secret Str0ngPass! | config | Set an encrypted enable secret password. |
| service password-encryption | config | Encrypt plaintext passwords stored in the configuration with type 7. |
| line console 0 | config | Enter configuration for the console line. |
Verify it
- show ip ssh
- show crypto key mypubkey rsa
- show running-config | section line vty
- show users
- show line
Common mistakes
- Trying to generate the RSA key before setting a hostname and domain name, which fails.
- Leaving transport input telnet on vty lines after intending to enforce SSH only.
- Setting only enable password without realizing enable secret, if present, always overrides it.
- Configuring login local without first creating a username, locking out remote access.
- Assuming service password-encryption provides strong protection; type 7 is trivially reversible.
Practise Device Hardening and Secure Remote Access in a real CLI
Generated labs, graded against the simulated network state.