Cisco CCNA Labs - Password Hardening

Lab Scenario:

You are a network administrator tasked with hardening the security of a Cisco router. The router currently has default configurations, and you need to implement strong password policies to protect it from unauthorized access.

Password Hardening Script:

Cisco CLI

enable
configure terminal
! Set strong enable password
enable secret MyStrongEnablePassword123!
! Set console password
line console 0
password MyConsolePassword456!
login
exec-timeout 10 0 ! Set console timeout to 10 minutes
! Set vty (Telnet/SSH) passwords
line vty 0 15
password MyVTYPassword789!
login local
transport input ssh ! Restrict to SSH only
exec-timeout 10 0 ! Set vty timeout to 10 minutes
! Configure local username and secret for SSH access
username admin secret MyAdminSecretPasswordABC!
! Disable services that are not needed
no ip domain-lookup ! Prevent DNS lookups, which can be a security risk
no cdp run ! Disable Cisco Discovery Protocol if not needed
no service password-encryption ! Do not use this command, as it is easily reversed.
! Configure login attempts and timeouts
login block-for 120 attempts 3 within 60 ! block for 120 seconds after 3 failed attempts within 60 seconds.
! Set a banner message
banner motd ^
Unauthorized access is prohibited. All actions are logged.
^
end
write memory

Explanation:

1. enable secret MyStrongEnablePassword123!:
   • Sets a strong encrypted password for privileged EXEC mode. The secret command is preferred over enable password because it uses stronger encryption.
2. line console 0:
   • Configures the console port.
3. password MyConsolePassword456!:
   • Sets a password for console access.
4. login:
   • Requires a password for console login.
5. exec-timeout 10 0:
   • Sets an exec timeout for 10 minutes, so that inactive sessions are closed.
6. line vty 0 15:
   • Configures the virtual terminal lines (Telnet/SSH).
7. password MyVTYPassword789!:
   • Sets a password for VTY access.
8. login local:
   • Requires local username/password authentication.
9. transport input ssh:
   • Restricts VTY access to SSH only, disabling Telnet.
10. username admin secret MyAdminSecretPasswordABC!:
    • Creates a local username and secret for SSH login.
11. no ip domain-lookup:
    • Disables DNS lookups, preventing potential information leaks.
12. no cdp run:
    • Disables Cisco Discovery Protocol (CDP) if it's not needed.
13. login block-for 120 attempts 3 within 60:
    • Blocks an attacker for 120 seconds after 3 failed login attempts within 60 seconds.
14. banner motd:
    • Displays a message of the day (MOTD) banner, warning unauthorized users.
15. write memory:
    • Saves the configuration to NVRAM.

Important Considerations:

• Password Strength: Use strong, complex passwords that are difficult to guess.
• SSH: Always prioritize SSH over Telnet for secure remote access.
• Regular Audits: Regularly audit your password policies and router configurations.
• Physical Security: Don't forget physical security. Securing the console port is very important.
• AAA: For larger networks, consider using AAA (Authentication, Authorization, and Accounting) with a centralized server (e.g., RADIUS, TACACS+).
• Adaptation: This script is a starting point. Tailor it to your specific security requirements and network environment.

 Checkout CCNA Labs at Cert-Ex™ Network Simulator w/ Designer for CCNA