LAB -2
Protecting Access to Privileged EXEC Commands
A simple way of providing terminal
access control in your network is to use passwords and assign privilege levels.
Password protection restricts access to a network or network device. Privilege levels
define what commands users can issue after they have logged into a network
device.
This section
describes how to control access to the configuration file and privileged EXEC
commands. It contains this configuration information:
1) Default Password and Privilege Level
Configuration
|
Default Password and Privilege Levels
|
|
Feature
|
Default
Setting
|
|
Username and password
|
Default username is Cisco and
the default password is Cisco.
|
|
Enable password and privilege level
|
Default password is Cisco. The
default is level 15 (privileged EXEC level). The password is encrypted in the
configuration file.
|
|
Enable secret password and privilege
level
|
The default enable password is Cisco.
The default is level 15 (privileged EXEC level). The password is encrypted
before it is written to the configuration file.
|
|
Line password
|
Default password is Cisco. The
password is encrypted in the configuration file.
|
2) Setting or Changing a Static Enable Password
The enable password controls access to
the privileged EXEC mode.
Note The no enable password global configuration command
removes the enable password, but you should use extreme care when using this
command. If you remove the enable password, you are locked out of the EXEC
mode.
Beginning in privileged EXEC mode, follow these steps to set
or change a static enable password:
|
|
Command
|
Purpose
|
|
Step 1
|
configure terminal
|
Enter global configuration mode.
|
|
Step 2
|
enable password password
|
Define a new password or change an
existing password for access to privileged EXEC mode.
The default password is Cisco.
For password, specify a
string from 1 to 25 alphanumeric characters. The string cannot start with a
number, is case sensitive, and allows spaces but ignores leading spaces. It can
contain the question mark (?) character if you precede the question mark with
the key combination Crtl-V when you create the
password; for example, to create the password abc?123, do this:
1. Enter abc.
2. Enter Crtl-V.
3. Enter ?123.
When the system prompts you to enter
the enable password, you need not precede the question mark with the Ctrl-V;
you can simply enter abc?123 at the password prompt.
Note Characters TAB, ?, $, +, and [
are invalid characters for passwords.
|
|
Step 3
|
end
|
Return to privileged EXEC mode.
|
|
Step 4
|
show running-config
|
Verify your entries.
|
|
Step 5
|
copy running-config
startup-config
|
(Optional) Save your entries in the
configuration file.
The enable password is not encrypted
and can be read in the wireless device configuration file.
|
This example shows how to change the
enable password to l1u2c3k4y5. The password is not encrypted and
provides access to level 15 (traditional privileged EXEC mode access):
AP(config)# enable password l1u2c3k4y5
3) Protecting Enable and Enable Secret Passwords
with Encryption
To provide an additional layer of security,
particularly for passwords that cross the network or that are stored on a
Trivial File Transfer Protocol (TFTP) server, you can use either the enable
password or enable secret global configuration commands. Both
commands accomplish the same thing; that is, you can establish an encrypted
password that users must enter to access privileged EXEC mode (the default) or
any privilege level you specify.
Cisco recommends that you use the enable
secret command because it uses an improved encryption algorithm.
If you configure the enable secret
command, it takes precedence over the enable password command; the two
commands cannot be in effect simultaneously.
Beginning in privileged EXEC mode,
follow these steps to configure encryption for enable and enable secret
passwords:
|
|
Command
|
Purpose
|
|
Step 1
|
configure terminal
|
Enter global configuration mode.
|
|
Step 2
|
enable password [level level] {password | encryption-type
encrypted-password}
or
enable secret [level level] {password | encryption-type
encrypted-password}
|
Define a new password or change an
existing password for access to privileged EXEC mode.
or
Define a secret password, which is
saved using a nonreversible encryption method.
�(Optional) For level, the range is from 0 to
15. Level 1 is normal user EXEC mode privileges. The default level is 15
(privileged EXEC mode privileges).
�For password, specify a string from 1 to 25
alphanumeric characters. The string cannot start with a number, is case
sensitive, and allows spaces but ignores leading spaces. By default, no
password is defined.
�(Optional) For encryption-type, only type 5, a
Cisco proprietary encryption algorithm, is available. If you specify an
encryption type, you must provide an encrypted password�an encrypted password
you copy from another access point configuration.
Note If you specify an encryption type and then enter a
clear text password, you can not re-enter privileged EXEC mode. You cannot
recover a lost encrypted password by any method.
|
|
Step 3
|
service password-encryption
|
(Optional) Encrypt the password when
the password is defined or when the configuration is written.
Encryption prevents the password from
being readable in the configuration file.
|
|
Step 4
|
end
|
Return to privileged EXEC mode.
|
|
Step 5
|
copy running-config
startup-config
|
(Optional) Save your entries in the
configuration file.
|
If both the enable and enable secret
passwords are defined, users must enter the enable secret password.
Use the level keyword to define
a password for a specific privilege level. After you specify the level and set
a password, give the password only to users who need to have access at this
level. Use the privilege level global configuration command to specify
commands accessible at various levels. For more information, see the
If you enable password encryption, it
applies to all passwords including username passwords, authentication key passwords,
the privileged command password, and console and virtual terminal line
passwords.
To remove a password and level, use the
no enable password [level level]
or no enable secret [level level]
global configuration command. To disable password encryption, use the no
service password-encryption global configuration command.
This example shows how to configure the
encrypted password $1$FaD0$Xyti5Rkls3LoyxzS8 for privilege level 2:
AP(config)# enable secret level 2 5 $1$FaD0$Xyti5Rkls3LoyxzS8
4. Configuring Username and Password Pairs
You can configure username and password
pairs, which are locally stored on the wireless device. These pairs are
assigned to lines or interfaces and authenticate each user before that user can
access the wireless device. If you have defined privilege levels, you can also
assign a specific privilege level (with associated rights and privileges) to
each username and password pair.
Beginning in privileged EXEC mode,
follow these steps to establish a username-based authentication system that
requests a login username and a password:
|
|
Command
|
Purpose
|
|
Step 1
|
configure terminal
|
Enter global configuration mode.
|
|
Step 2
|
username name [privilege level] {password encryption-type password}
|
Enter the username, privilege level,
and password for each user.
�For name, specify the user ID as one word.
Spaces and quotation marks are not allowed.
�(Optional) For level, specify the privilege
level the user has after gaining access. The range is 0 to 15. Level 15 gives
privileged EXEC mode access. Level 1 gives user EXEC mode access.
�For encryption-type, enter 0 to specify that
an unencrypted password will follow. Enter 7 to specify that a hidden
password will follow.
�For password, specify the password the user
must enter to gain access to the wireless device. The password must be from 1
to 25 characters, can contain embedded spaces, and must be the last option
specified in the username command.
|
|
Step 3
|
login local
|
Enable local password checking at
login time. Authentication is based on the username specified in Step 2.
|
|
Step 4
|
end
|
Return to privileged EXEC mode.
|
|
Step 5
|
show running-config
|
Verify your entries.
|
|
Step 6
|
copy running-config
startup-config
|
(Optional) Save your entries in the
configuration file.
|
To disable username authentication for a
specific user, use the no username name global configuration
command.
To disable password checking and allow
connections without a password, use the no login line configuration
command.
Note You must have at least one username configured and you
must have login local set to open a Telnet session to the wireless device. If
you enter no username for the only username, you can be locked out of the
wireless device.
5. Configuring Multiple Privilege Levels
By default, Cisco IOS software has two
modes of password security: user EXEC and privileged EXEC. You can configure up
to 16 hierarchical levels of commands for each mode. By configuring multiple
passwords, you can allow different sets of users to have access to specified
commands.
For example, if you want many users to
have access to the clear line command, you can assign it
level 2 security and distribute the level 2
password fairly widely. But if you want more restricted access to the configure
command, you can assign it level 3 security and distribute that password to a
more restricted group of users.
This section includes this
configuration information:
�Setting the Privilege
Level for a Command
Beginning in privileged EXEC mode,
follow these steps to set the privilege level for a command mode:
|
|
Command
|
Purpose
|
|
Step 1
|
configure terminal
|
Enter global configuration mode.
|
|
Step 2
|
privilege mode level
level command
|
Set the privilege level for a
command.
�For mode, enter configure for global
configuration mode, exec for EXEC mode, interface for interface
configuration mode, or line for line configuration mode.
�For level, the range is from 0 to 15. Level 1
is for normal user EXEC mode privileges. Level 15 is the level of access
permitted by the enable password.
�For command, specify the command to which you
want to restrict access.
|
|
Step 3
|
enable password level level password
|
Specify the enable password for the
privilege level.
�For level, the range is from 0 to 15. Level 1
is for normal user EXEC mode privileges.
�For password, specify a string from 1 to 25
alphanumeric characters. The string cannot start with a number, is case
sensitive, and allows spaces but ignores leading spaces. By default, no
password is defined.
Note Characters TAB, ?, $, +, and [
are invalid characters for passwords.
|
|
Step 4
|
end
|
Return to privileged EXEC mode.
|
|
Step 5
|
show running-config
or
show privilege
|
Verify your entries.
The first command displays the password
and access level configuration. The second command displays the privilege
level configuration.
|
|
Step 6
|
copy running-config
startup-config
|
(Optional) Save your entries in the
configuration file.
|
When you set a command to a privilege
level, all commands whose syntax is a subset of that command are also set to
that level. For example, if you set the show ip
route command to level 15, the show commands and show ip commands are automatically set to privilege level 15
unless you set them individually to different levels.
To return to the default privilege for
a given command, use the no privilege mode level level command global configuration
command.
This example shows how to set the configure
command to privilege level 14 and define SecretPswd14 as the password
users must enter to use level 14 commands:
AP(config)# privilege exec level 14 configure
AP(config)# enable password level 14 SecretPswd14
6. Logging Into and Exiting a Privilege Level
Beginning in privileged EXEC mode,
follow these steps to log in to a specified privilege level and to exit to a
specified privilege level:
|
|
Command
|
Purpose
|
|
Step 1
|
enable level
|
Log in to a specified privilege
level.
For level, the range is 0 to
15.
|
|
Step 2
|
disable level
|
Exit to a specified privilege level.
For level, the range is 0 to
15.
|
Please hand in:
- All the
change you made from the web interface
- All
the command you use from the command line page
- Make
sure put your First name, Last name and Student number