CCNA - Capitulo 16.4

CCNA - Capitulo 16.4

1. DEVICE SECURITY

   • CISCO AUTO SECURE
     • FEATURE CAN BE USED TO ASSIST SECURING THE SYSTEM
     • ROUTER#AUTO SECURE
     • STEPS
       • DEFAULT USERNAMES AND PASSWORDS
         • SHOULD BE CHANGED IMMEDIATELY.
       • ACCESS TO SYSTEM RESOURCES SHOULD BE RESTRICTED TO
         • ONLY THE INDIVIDUALS THAT ARE AUTHORIZED TO USE THOSE RESOURCES.
       • ANY UNNECESSARY SERVICES AND APPLICATIONS
         • SHOULD BE TURNED OFF AND UNINSTALLED WHEN POSSIBLE.
   • STANDARD GUIDELINES - PASSWORD
     • LENGHT OF AT LEAST EIGHT
       • PREFERABLY 10 OR MORE CHARACTERS
       • A LONGER PASSWORD IS A MORE SECURE
     • AVOID PASSWORD BASED
       • REPETITION
       • COMMOM DICTIONARY WORDS
       • LETTER OR NUMBER SEQUENCES
       • BIOGRAPHICAL INFORMATION, SUCH AS BIRTHDATES, ID NUMBERS,
       • ANCESTOR NAMES, OR OTHER EASILY IDENTIFIABLE PIECES OF INFORMATION.
     • DELIBERATELY MISSPELL
       • EX : 5ECUR1TY
     • DO NOT WRITE
     • MAKE PASSOWORD COMPLEX
       • MIX OF UPPERCASE AND LOWERCASE
         • LETTERS , NUMBERS , SYMBOLS , AND SPACES , IF ALLOWED
     • CHANGE PASSWORDS OFTEN.
   • ADDITIONAL PASSWORD SECURITY
   • ADDITIONAL PASSWORD SECURITY
     • ENCRYPTING ALL
       • PLAINTEXT PASSWORDS
         • SWITCH(CONFIG)# SERVICE PASSWORD-ENCRYPTION
     • SETTING A MINIMUM ACCEPTABLE
       • PASSWORD LENGTH
       • SWITCH(CONFIG)#SERVICE PASSWORDS MIN-LENGHT
     • DISABLING AN INACTIVE PRIVILEGED EXEC MODE ACCESS
       • AFTER A SPECIFIED AMOUNT OF TIME.
     • DDOS PROTECTION?
       • SWITCH(CONFIG)#LOGIN BLOCK FOR 120 ATTEMPTS 3 WITHIN 60
         • DETERRING BRUTE-FORCE PASSWORD
           • GUESSING ATTACKS
     • PREVENT MODE EXEC OPEN?
       • SWITCH (CONFIG-LINE) #EXEC-TIMEOUT
   • ENABLE SSH
     • 6 STEPS
       • STEP 1. CONFIGURE A UNIQUE DEVICE HOSTNAME
         • S1(CONFIG)#HOSTNAME SWITCH-ACESSO-A
       • STEP 2. CONFIGURE THE IP DOMAIN NAME.
         • SWITCH-ACESSO-A(CONFIG)#IP DOMAIN-NAME EMPRESA.COM
       • STEP 3. GENERATE A KEY TO ENCRYPT SSH TRAFFIC.
         • SWITCH-ACESSO-A(CONFIG)#CRYPTO KEY GENERATE RSA 1024
       • STEP 4. VERIFY OR CREATE A LOCAL DATABASE ENTRY.
         • SWITCH-ACESSO-A(CONFIG)#USARNAME ADMIN PASSWORD ADMIN
       • STEP 5. AUTHENTICATE AGAINST THE LOCAL DATABASE.
         • SWITCH-ACESSO-A(CONFIG-LINE)#LOGIN LOCAL
       • STEP 6. ENABLE VTY INBOUND SSH SESSIONS.
         • SWITCH-ACESSO-A(CONFIG-LINE)#TRANSPORT INPUT SSH
   • DISABLE UNSED SERVICES
     • DISABLE ANY UNSED SERVICES
       • PRESERVE SYSTEM RESOURCES SUCH CPF CYCLES AND RAM
     • HOW TO VERIFY SERVICES IN CISCO IOS XE ?
       • ROUTER#SHOW IP PORTS ALL
     • IOS VERSIONS PRIOR TO IOS XE ?
       • ROUTER#SHOW CONTROL-PLANE HOST OPEN-PORTS
     • HOW DO I DISABLE DISABLE HTTP ?
       • ROUTER(CONFIG)# NO IP HTTP SERVER
     • HOW DO I DISABLE TELNET?
       • SPECIFYING ONLY SSH IN THE LINE CONFIGURATION
       • ROUTER(CONFIG-LINE)# TRANSPORT INPUT SSH