Cisco router C1101-4P

[zeljkosan]

Hello team,

I have temporary solution at client place in which we had to put router on open static public IP instead of firewall.

So, I need to put complex password encryption, but so far I have these lines:

username some_user privilege 0 secret 9

and

enable password 7

What can I do more to secure connection to router (access list for certain public IP does is not recommended since there are larger number of public IP which must connect to it)

[M02@rt37 · Accepted solution]

Hello @zeljkosan 

use enable secret insteaf of enable password. Secret type 5 or 9 are much stronger , never use type 7...

Also, restric SSH connection on VTYs:

line vty 0 4

transport input ssh

ip ssh autehtication-retries 3

access-class 1 in

-> add standard acl (1) if possible that match IP sources authorized to SSH that routeur. 

Disable also protocols not needed, as an example:

no ip http server

no ip http secrue-server

no ip bootp server

-> you could find others commands...

Send log to syslog server so you can see login attemps !

Prefer using TACACS+ than radius or local username _ if you can... in that way you can centralized logging, per user accountability, command authorization and fallback for resilience...

[Rich R · Accepted solution]

Note MD5 hash is not considered to be secure anymore M02@rt37 - it can be cracked very easily by modern cracking tools with current CPU capabilities - doesn't even require advanced hardware.

Some reference material to read ...

Harden IOS Devices

Cisco IOS XE Software Hardening Guide

Understanding the differences between the Cisco password \ secret Types

Cisco Password Types: Best Practices

And remember IOS-XE has zone based firewall built in as long as you have the right license.

[M02@rt37]

Hello @Rich R 

Exactly! Thanks to notice this. Modern CPU and GPU can compute billions of MD5 hashes per second... making brute-force and dictionnary attacks trivial !

Thanks again.

[David Ruess]

IN addition to the already suggested methods you could also place an ACL on the interface itself restricting traffic further from reaching the device. You could start with an ACL defining the Private IP spaces as you shouldn't see private IPs as a source coming from a public facing internet. As you identify more traffic you can either block or permit as needed.

-David

[MHM Cisco World]

Be evil LOL

Use rotary under vty this prevents any any hacker to try telnet/ssh to router because he dont know this new port

And then block port 22/23 

MHM

[zeljkosan]

Hello team, thank you for help. We will install some smaller firewall there in near future