username prompt when telneting to a rtr

[Live2 Bicycle]

When I telnet the a rtr it prompts me for a username then password. Once I got in to the cfg I did a no username and the username listed. I then did a copy run start. From a new telnet session I connected to the rtr again. It still prompted me for a username. What else do I need to do to shut this off? There are NO More usernames listed.

[paddyxdoyle]

Hi,

You need to look at your vty line config and you will probably see:

line vty 0 4

login local

Remove this and add

line vty 0 4

password enter_your_password

login

This should do the trick, also check your console line (line con 0) as it might also have "login local" too.

Rgds

Paddy

[Live2 Bicycle]

The VTY's read

line vty 0

exec-timeout 30 0

password 7 062506324F1E26090005131F050B2438

logging synchronous

line vty 1 4

exec-timeout 30 0

password 7 096F471A1A5538020E1E053E222B2620

logging synchronous

[paddyxdoyle]

Try adding "login" to both "line vty 0" and "line vty 1 4"?

[Richard Burts]

do you perhaps have the router configured with something like:

aaa authentication login default group tacacs+

If so the prompt for user name is not generated locally by the router (which is what the replies so far have assumed) but is generated by a request from the aaa server. If you want to not have the prompt for username removce the aaa configuration.

HTH

Rick

[Live2 Bicycle]

I do have the router setup for AAA so users can vpn to the router to gain access to local resourses. Since I have this does this mean I will alwasy have a username and password prompt when I telnet to the rtr?

Here is the config

aa group server radius IAS

server XXX.XXX.XXX.XXX auth-port 1645 acct-port 1646

!

aaa authentication login userauthen group IAS

aaa authorization network groupauthor local

aaa accounting network default start-stop group IAS

aaa session-id common

[mondellojjj]

You will always get this when aaa is enabled and the device is set to authenticate with tacacs/radius. I would recommend keeping the local usernames in the event that your ACS goes down. That way you will still have a login. Hope this helps.

Johny

[omarmontes]

Im not sure what do you want to do:

If you want to be able to telnet your router without the need of a username do:

line vty 0 4

no login

If you want to deny the access to the vty line you can use:

line vty 0 4

no password

If you want to be asked for a username and password:

line vty 0 4

login local

If you want to be asked only for a password:

vty line 0 4

login

password yourpassword

I think thats it :P

[Richard Burts]

Actually when you have configured aaa authentication, then things like login local do not work any more.

I faced a situation like this at a customer site where we wanted authentication for telnet to work differently that users accessing the router other ways (which would include VPN).

The solution we came up with defines two authentication methods, the default and a local one (which I will call admin). The default uses aaa and tacacs (or in your case radius) and the admin would use local authentidation. The config would look something like this.

line con 0

login authentication admin

line vty 0 4

login authentication admin

!

aaa authentication login default group IAS

aaa authentication login admin local

With this config the VPN users would authenticate with radius which would require userID and password while people logging in to the console or to telnet would only be prompted for the normal line password.

HTH

Rick

[archie_25]

I was reading through the replies to this post and appreciate how you laid out the vty information.

Would you happen to know what would happen with this configuration?

vty line 0 4

password yourpassword

Without the keyword, login, would someone be prompted for a password? I know vty lines require a password to work, and I believe you need keyword login to get the password prompt...if both are the case, what would happen if login was not configured but password was?

Get access to User Exec without password via telnet?

[Richard Burts]

The configuration you ask about in which the vty ports are configured with a password but without the login command is essentially the configuration that the original poster was asking about.

The behavior you describe of being able to get into user mode without a password if the vty ports did not have login specified was the traditional behavior and is the case now if there is no aaa configured. However when aaa is configured the behavior of the router changes and one of the changes is that the vty ports are treated as if there were a login command even if there is not one in the config. So in the configuration that you ask about where aaa is configured and the vty has a password but no login command then aaa will use the default login authentication method (however that is configured on your router).

HTH

Rick