Password protect console session

[Charger1129]

Hi. How can I password protect a console session so that someone is prompted when plugging a console in to a network switch? 

[acampbell]

Hi,

config t

!
service password-encryption
!
enable secret PASSWORD
!
line console 0
password PASSWORD
!
line vty 0 4
pasword PASSWORD
!
end

http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c.html

Regards
Alex

[Charger1129]

No luck. I don't get any prompts going in through a console session. Only if I elevate to exec mode it prompts for a password but I want it to prompt from the very start. 

It's a Cisco 3560 Switch

[acampbell]

Hi,

So are you connected directly into the console port or are you accessing via telnet/ssh ?

If you are on the console direct the to see a prompt for security you need to configure

conf t

!

line cons 0

password YOURPASSWORD

!

end

quit

and retry the console port you should now require a password when you hit carriage return

Regards

Alex

[Charger1129]

So here's what I have and still no luck. The minute i open a Putty with a console cable plugged in I go right in to SWITCH>

line con 0
password 7 0202165A0E2570B2E5F

[acampbell · Accepted solution]

Hi,

Can you try adding the lines like this

enable
!
conf t
line cons 0
password YOURPWD
login
!
end

quit

Wait 5 secs
Hit return & test

Regards
Alex

[Charger1129]

So i can't do "login" has to be "login authentication...."

[acampbell · Accepted solution]

Hi,

So this means you have aaa new-model configured, I guess you are using TACAs+ or radius.

If not can you share you switch config as may be someone else has left config on the box which is stopping your needs.

Regards

Alex

[Charger1129]

Looks like that did it! I'm not using RADIUS or TACACS at the moment, but i removed aaa new-model and was able to set it. Now I get prompted.

If I was using RADIUS or TACACS though, would i be unable to accomplish this?

[acampbell]

Hi,

If you were to use TACACS+ everyone who loggs on to
the box whether console port or telnet/ssh would need a username and password.

Users can be set up with different rights e.g.

May be you as full admin would have acess to all show,config read & write.

May be a different user could have show as read only etc.

Loads of info at:-
http://www.cisco.com/c/en/us/tech/security-vpn/terminal-access-controller-access-control-system-tacacs/index.html?referring_site=bodynav

Hope this helps
Regards
Alex

[Charger1129]

Right. Got it good to know. At least it can be done so you have a password in all areas either local or through TACACS. Thanks again for the help!

[Masoud Pourshabanian]

Hello,

Adding to Alex's answer.

line console 0

exec-timeout 5 0     [ 5 minutes  0 second]

It will end the session after 5 minutes if session is idle.

Masoud