ISCW10S05L03路由器安全与访问管理.ppt

CiscoDeviceHardening,SecuringCiscoRouterInstallationsandAdministrativeAccess,ConfiguringRouterPasswords,ConfiguringRouterPasswords,Aconsoleisaterminalconnectedtoarouterconsoleport.TheterminalcanbeadumbterminaloraPCwithterminalemulationsoftware.,PasswordCreationRules,Passwordscanbe1to25charactersinlength.Passwordscaninclude:AlphanumericcharactersUppercaseandlowercasecharactersSymbolsandspacesPasswordscannothaveanumberasthefirstcharacter.Password-leadingspacesareignored,butanyspacesafterthefirstcharacterarenotignored.Changepasswords.,InitialConfigurationDialog,Wouldyouliketoentertheinitialconfigurationdialog?yes/noyConfiguringglobalparameters:EnterhostnameRouter:BostonTheenablesecretisapasswordusedtoprotectaccesstoprivilegedEXECandconfigurationmodes.Thispassword,afterentered,becomesencryptedintheconfiguration.Enterenablesecret:CantGuessMeTheenablepasswordisusedwhenyoudonotspecifyanenablesecretpassword,withsomeoldersoftwareversions,andsomebootimages.Enterenablepassword:WontGuessMeThevirtualterminalpasswordisusedtoprotectaccesstotherouteroveranetworkinterface.Entervirtualterminalpassword:CantGuessMeVTY,ConfiguretheLine-LevelPassword,router(config)#,lineconsole0lineaux0linevty04,router(config-line)#,login,router(config-line)#,passwordpassword,Enterslineconfigurationmode(console,auxiliary,orvty),Enablespasswordcheckingatlogin,Setstheline-levelpassword,Boston(config)#linecon0Boston(config-line)#loginBoston(config-line)#passwordConUser1,PasswordMinimumLengthEnforcement,router(config)#,securitypasswordsmin-lengthlength,SetstheminimumlengthofallCiscoIOSpasswords,Boston(config)#securitypasswordsmin-length10,EncryptingPasswordsUsingtheservicepassword-encryptionCommand,servicepassword-encryption,Encryptsallpasswordsintherouterconfigurationfile,router(config)#,Boston(config)#servicepassword-encryptionBoston(config)#exitBoston#showrunning-configenablepassword706020026144A061E!linecon0password70956F57A109A!linevty04password7034A18F366A0!lineaux0password77A4F5192306A,EnhancedUsernamePasswordSecurity,router(config)#,usernamenamesecret0password|5encrypted-secret,UsesMD5hashingforstrongpasswordprotectionBetterthanthetype7encryptionfoundinservicepassword-encryptioncommand,Boston(config)#usernamertradminsecret0Curium96Boston(config)#usernamertradminsecret5$1$feb0$a104Qd9UZ./Ak007,router(config)#,usernamenamepassword0password|7hidden-password,Traditionaluserconfigurationwithplaintextpassword,SecuringROMMONwiththenopassword-recoveryCommand,router(config)#,noservicepassword-recovery,Bydefault,Ciscoroutersarefactoryconfiguredwiththeservicepassword-recoveryset.Thenoservicepassword-recoverycommandpreventsconsolefromaccessingROMMON.,Boston(config)#noservicepassword-recoveryWARNING:Executingthiscommandwilldisablepasswordrecoverymechanism.Donotexecutethiscommandwithoutanotherplanforpasswordrecovery.Areyousureyouwanttocontinue?yes/no:yesBoston(config)#,SettingaLoginFailureRate,AuthenticationFailureRatewithLogin,router(config)#,securityauthenticationfailureratethreshold-ratelog,ConfiguresthenumberofallowableunsuccessfulloginattemptsBydefault,routerallows10loginfailuresbeforeinitiatinga15-seconddelayGeneratesasyslogmessagewhenrateisexceeded,Boston(config)#securityauthenticationfailurerate10log,SettingaLoginFailureBlockingPeriod,router(config)#,loginblock-forsecondsattemptstrieswithinseconds,BlocksaccessforaquietperiodafteraconfigurablenumberoffailedloginattemptswithinaspecifiedperiodMustbeenteredbeforeanyotherlogincommandMitigatesDoSandbreak-inattacks,Boston(config)#loginblock-for100attempts2within100,ExcludingAddressesfromLoginBlocking,router(config)#,loginquiet-modeaccess-classacl-name|acl-number,SpecifiesanACLthatisappliedtotherouterwhenitswitchestothequietmode.Ifnotconfigured,allloginrequestswillbedeniedduringthequietmode.ExcludesIPaddressesfromfailurecountingforloginblock-forcommand.,Boston(config)#loginquiet-modeaccess-classmyacl,SettingaLoginDelay,router(config)#,logindelayseconds,Configuresadelaybetweensuccessiveloginattempts.Helpsmitigatedictionaryattacks.Ifnotset,adefaultdelayofonesecondisenforcedaftertheloginblock-forcommandisconfigured.,Boston(config)#logindelay30,VerifyingLogin,router#,showloginfailures,Displaysloginparametersandfailures,Boston(config)#showloginAdefaultlogindelayof1secondsisapplied.NoQuiet-Modeaccesslisthasbeenconfigured.AllsuccessfulloginisloggedandgenerateSNMPtraps.AllfailedloginisloggedandgenerateSNMPtraps.RouterenabledtowatchforloginAttacks.Ifmorethan15loginfailuresoccurin100secondsorless,loginswillbedisabledfor100seconds.RouterpresentlyinWatch-Mode,willremaininWatch-Modefor95seconds.Presentloginfailurecount5.,SettingTimeouts,SettingTimeoutsforRouterLines,router(config-line)#,exec-timeoutminutesseconds,Defaultis10minutesTerminatesanunattendedconnectionProvidesanextrasafetyfactorwhenanadministratorwalksawayfromanactiveconsolesession,Terminatesanunattendedconsoleandauxiliaryconnectionafter3minutesand30seconds,Boston(config)#lineconsole0Boston(config-line)#exec-timeout330Boston(config)#lineaux0Boston(config-line)#exec-timeout330,SettingMultiplePrivilegeLevels,SettingMultiplePrivilegeLevels,router(config)#,privilegemodelevellevelcommand|resetcommand,Level0ispredefinedforuser-levelaccessprivileges.Levels1to14maybecustomizedforuser-levelprivileges.Level15ispredefinedforenablemode(enablecommand).,Boston(config)#privilegeexeclevel2pingBoston(config)#enablesecretlevel2Patriot,ConfiguringBannerMessages,ConfiguringBannerMessages,router(config)#,bannerexec|incoming|login|motd|slip-pppdmessaged,Specifieswhatis“properuse”ofthesystemSpecifiesthatthesystemisbeingmonitoredSpecifiesthatprivacyshouldnotbeexpectedwhenusingthissystem,Boston(config)#bannermotd%WARNING:Youareconnectedto$(hostname)ontheCiscoSystems,Incorporatednetwork.Unauthorizedaccessanduseofthisnetworkwillbevigorouslyprosecuted.%,ConfiguringRole-BasedCLI,Role-BasedCLIOverview,TraditionalapproachoflimitingCLIaccessbasedonprivilegelevelsandenablepasswordsprovidedtoolittlecontrol:NoaccesscontroltospecificinterfacesCommandsplacedonahigherprivilegelevelcouldnotbereusedforlower-privilegedusersCLIviewsprovidemoregranularcontrol.CLIviewsincludeaccessiblecommandsandinterfaces.Accesstoaviewisprotectedwithasecret.Viewscanbegroupedtosuperviewstocreatelargesetsofaccessiblecommandsandinterfaces.,Role-BasedCLIDetails,Rootviewisthehighestadministrativeview.Creatingandmodifyingavieworsuperviewispossibleonlyfromrootview.Thedifferencebetweenrootviewandprivilege15isthatonlyarootviewusercancreateormodifyviewsandsuperviews.CLIviewsrequireAAAnew-model:NecessaryevenwithlocalviewauthenticationViewauthenticationcanbeoffloadedtoanAAAserverusingthenewattributecli-view-nameAmaximumof15CLIviewscanexistinadditiontotherootview.,GettingStartedwithRole-BasedCLI,router#,enableprivilege-levelviewview-name,EnteraprivilegeleveloraCLIview.Useenablecommandwiththeviewparametertoentertherootview.Rootviewrequiresprivilege15authentication.Theaaa-newmodelmustbeenabled.,Boston(config)#aaanew-modelBoston(config)#exitBoston#enableviewPassword:Boston#%PARSER-6-VIEW_SWITCH:successfullysettoviewroot,ConfiguringCLIViews,router(config)#,Createsaviewandentersviewconfigurationmode,Boston(config)#parserviewmonitor_viewBoston(config-view)#password5hErMeNe%GiLdE!Boston(config-view)#commandsexecincludeshowversion,parserviewview-name,router(config-view)#,password5encrypted-passwordcommandsparser-modeinclude|include-exclusive|excludeallinterfaceinterface-name|command,SetsapasswordtoprotectaccesstotheviewAddscommandsorinterfacestoaview,ConfiguringSuperviews,router(config)#,Createsa(super)viewandentersitsconfiguration,Boston(config)#parserviewmonitor_auditBoston(config-view)#password5AnA6TaSiA$Boston(config-view)#viewmonitor_viewBoston(config-view)#viewaudit_view,parserviewview-name,router(config-view)#,password5encrypted-passwordviewview-name,SetsapasswordtoprotectaccesstothesuperviewAddsaCLIviewtoasuperview,Role-BasedCLIMonitoring,router#,DisplaysthecurrentviewnameTheoptionall:DisplaysallCLIviewsconfiguredontherouterIsbydefaultavailableonlytorootusersCanbeaddedtootherCLIviews,showparserviewall,router#,debugparserview,Displaysdebugmessagesforallviews,Role-BasedCLIConfigurationExample,Boston(config)#aaanew-modelBoston(config)#exitBoston#enableview%PARSER-6-VIEW_SWITCH:successfullysettoviewroot.Boston#configureterminalBoston(config)#parserviewfirst%PARSER-6-VIEW_CREATED:viewfirstsuccessfullycreated.Boston(config-view)#secret5firstpassBoston(config-view)#commandexecincludeshowversionBoston(config-view)#commandexecincludeconfigureterminalBoston(config-view)#commandexecincludeallshowipBoston(config-view)#exit,Role-BasedCLIVerification,BostonenableviewfirstPassword:%PARSER-6-VIEW_SWITCH:successfullysettoviewfirst.Boston#?Execcommands:configureEnterconfigurationmodeenableTurnonprivilegedcommandsexitExitfromtheEXECshowShowrunningsysteminformationBoston#show?ipIPinformationparserDisplayparserinformationversionSystemhardwareandsoftwarestatus,Role-BasedCLIVerification(Cont.),Boston#showip?access-listsListIPaccesslistsaccountingTheactiveIPaccountingdatabasealiasesIPaliastablearpIPARPtableas-path-access-listListASpathaccesslistsbgpBGPinformationcacheIPfast-switchingroutecachecasaDisplaycasainformationcefCiscoExpressForwardingcommunity-listListcommunity-listdfpDFPinformationdhcpShowitemsintheDHCPdatabasedrp-More-,SecureConfigurationFiles,SecureConfigurationFilesIntroduction,Traditionalriskthattheconfigurationandtheimageareerasedafteraroutercompromise:Availabilitythreat(downtime)Needtosecuretheprimarybootset(configurationfileandtherunningimage)AlsoknownastheCiscoIOSResilientConfigurationfeatureSpeedsuptherecoveryprocessFilesmustbestoredlocallyFeaturecanbedisabledthroughaconsolesession,SecuringConfigurationFiles,router(config)#,EnablesCiscoIOSimageresilience,Boston(config)#secureboot-imageBoston(config)#secureboot-config,secureboot-image,router(config)#,secureboot-config,Storesasecurecopyoftheprimarybootsetinpersistentstorage,router#,Displaysthestatusofconfigurationresilienceandtheprimarybootsetfilename,showsecurebootset,CiscoIOSResilientConfigurationFeatureVerification,Boston#showsecurebootsetIOSresiliencerouteridJMX0704L5GHIOSimageresilienceversion12.3activatedat08:16:51UTCSunJun162005Securearchiveslot0:c3745-js2-mztypeisimage(elf)filesizeis25469248bytes,runsizeis25634900bytesRunnableimage,entrypoint0 x80008000,runfromramIOSconfigurationresilienceversion12.3activatedat08:17:02UTCSunJun162002Securearchiveslot0:.runcfg-20020616-081702.artypeisconfigconfigurationarchivesize1059bytes,SecureConfigurationFilesRecovery,rommon1,Liststheconte