Securing device access: secrets and SSH

Why harden devices?

Hardening means removing easy ways in. A new Cisco device is built to be easy to set up, not to be safe on a live network. Anyone who gets into a router can read its configuration, redirect traffic or take the network down. So the first job after the basic setup is to lock the doors: the console, the VTY lines (the virtual lines used for remote logins) and privileged EXEC mode.

enable secret, not enable password

Privileged EXEC mode (the # prompt) can change anything, so it needs a password. enable password stores it in plain text in the configuration. enable secret stores a one-way hash, which cannot simply be turned back into the password. If both are set, the device uses enable secret and ignores enable password.

Router(config)# hostname R1
R1(config)# enable secret Ch@iT1me-2026!
R1(config)# service password-encryption
R1(config)# username admin secret Str0ng-Passphrase-77
R1(config)# do show running-config | include secret|password

Local users and login local

A shared line password gives no accounting: you cannot tell who logged in. Instead, create a username for each engineer and tell the lines to check the local user list with login local. In larger networks the same idea moves to a TACACS+ or RADIUS server, with local users kept as a fallback.

SSH instead of Telnet

Telnet (TCP 23) sends everything in clear text, including the password. Anyone who can capture the traffic can read it. SSH (Secure Shell, TCP 22) encrypts the whole session. SSH needs an RSA key pair, and the key name is built from the hostname and domain name, so those come first.

R1(config)# hostname R1
R1(config)# ip domain-name campus.local
R1(config)# crypto key generate rsa modulus 2048
R1(config)# ip ssh version 2
R1(config)# username admin secret Str0ng-Passphrase-77
R1(config)# line vty 0 4
R1(config-line)# transport input ssh
R1(config-line)# login local
R1(config-line)# exec-timeout 5 0
R1(config-line)# exit

1. Set a hostname other than the default Router or Switch.
2. Set a domain name with ip domain-name.
3. Generate the RSA keys: crypto key generate rsa modulus 2048. SSH version 2 needs at least 768 bits; 2048 is the sensible minimum today.
4. Force version 2 with ip ssh version 2. Version 1 has known weaknesses.
5. Create a local user with a secret.
6. On the VTY lines allow only SSH (transport input ssh) and use login local.
7. Test from a PC: ssh -l admin 192.168.1.1, and check with show ip ssh and show ssh.

Timeouts, login delays and banners

exec-timeout 5 0 logs out an idle session after 5 minutes and 0 seconds, so a forgotten open session on a desk PC does not stay logged in all day. login block-for 120 attempts 3 within 60 blocks all logins for 120 seconds if 3 attempts fail within 60 seconds, which slows password guessing. A banner motd shows a legal warning before login; it does not stop anyone, but it makes clear that access is only for authorised users.

R1(config)# login block-for 120 attempts 3 within 60
R1(config)# banner motd # Authorised access only. Activity is logged. #
R1(config)# line console 0
R1(config-line)# login local
R1(config-line)# exec-timeout 5 0
R1(config-line)# exit
R1(config)# no ip http server
R1(config)# no ip http secure-server

Turn off what you do not use

Every running service and every live port is a possible way in. On switches, shut down unused access ports and move them into an unused VLAN that goes nowhere, so a cable plugged in later gets no network. Turn off the HTTP server unless you really use the web GUI (and if you do, prefer HTTPS).

SW1(config)# vlan 999
SW1(config-vlan)# name UNUSED
SW1(config-vlan)# exit
SW1(config)# interface range gigabitEthernet1/0/20 - 24
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# switchport access vlan 999
SW1(config-if-range)# shutdown

Common mistakes and fixes

• SSH "does not work": usually the RSA keys were never generated, or the hostname is still the default. Check with show ip ssh.
• Locked out after login local: you forgot to create a username first. Always create the user before you change the lines, and keep a console session open while you test.
• transport input all left on the VTY lines: Telnet is still allowed. Use transport input ssh.
• Only lines 0 to 4 secured on a switch with 16 lines: lines 5 to 15 still accept Telnet. Configure line vty 0 15.