Configuring a Telnet Session Time−Out Value

To lower the chances for vulnerability when an administrator walks away from a logged−in Telnet session, you can configure and apply a time−out condition to unused VTY sessions. Here’s how:

HSNRSM (config)# line vty 0 4

HSNRSM (config−line)# exec−timeout 5 0

We just set the timeout value to five minutes and zero seconds.

Implementing Privilege Levels on a 1900EN

To assign a user a privilege level and a defined set of commands you first need to select a user and associate that user with a privilege level. To do this, use the following command in Global Configuration mode:

1900EN(config)# privilege configure level 3 password

You should assign a password for each configured privilege level. To assign the password brad1 to privilege level 3, use the following command:

1900EN (config)# enable secret level 3 brad1

When Brad wants to log in to the switch, he will use the following command:

1900EN (config)# username blarson password brad1

This setup allows the user blarson to use certain show commands by default, but gives him no access to the debug or configuration commands.

To allow the user to use all the debug commands in privilege level 3, use the following command:

1900EN (config)# privilege exec level 3 debug

To allow users with a privilege level 3 to use only a certain command syntax for debug, such as debug ip, use the following command:

1900EN (config)# privilege exec level 3 debug ip

Note Privilege level 0 includes five commands associated with the privilege level: disable, enable, exit, help, and logout.

Configuring Line Console Time−Out Values

To configure a time−out value, use the following command. The time−out value is being set to five minutes, measured in seconds:

hsn(config)# line console hsn(config)# time−out 300

Tip You can use the lock command to lock an unused Telnet session. After you issue the lock command, the system will ask you to enter and verify an unlocking password.

To configure a Set/Clear command−based switch with a time−out value of five minutes, use the following command:

hsn# set logout 5

267

To configure the time−out value to five minutes on the console port of an IOS−based route processor or router, use the following command:

HSNRSM (config)# line console 0

HSNRSM (config−line)# exec−timeout 5

To configure the time−out value to five minutes on the VTY port of an IOS−based route processor or router, use the following command:

HSNRSM (config)# line vty 0 4

HSNRSM (config−line)# exec−timeout 5

Tip To configure seconds beyond a round number of minutes, you can add an additional value to the command. For example, if you want the exec−timeout to be 5 minutes and 10 seconds, the command is exec−timeout 5 10.

Configuring Banner Messages

To configure a Message Of The Day (MOTD) banner on a Set/Clear command−based switch, use the following command from a Privileged mode prompt:

CAT5K(enable) set banner motd ÔWe Prosecute Unauthorized Access!’

To configure a MOTD banner on a Cisco IOS command−based switch or route processor, use the following command from a Global Configuration mode prompt:

1912EN(config)# banner login ÔWe Prosecute Unauthorized Access!’

Enabling HTTP Access

Starting with the release of version 11.0(6) of the Cisco IOS, Cisco included HTTP server software, which allows you manage the Cisco IOS from a Web browser. This software makes managing your switches easier—but opens one giant security hole.

By default, access through HTTP is disabled. To enable access through HTTP, use the following command:

CAT5KRSM(config)# ip http server

An access list can be configured to allow you to choose the IP address of the network device that can be used to access the switch. For example, use the following command to allow a PC with the IP address 15.47.112.10 for access list 2:

CAT5KRSM(config)# access−list 2 permit 15.47.112.10

Suppose this is the only statement in the access list. Because of the implied “deny all,” once this access list is applied, only a PC with IP address 15.47.112.10 will be able to manage the switch. Before this filter will work, however, you must still apply the access list, state the authentication type, and configure the username and password. To apply the access list, use the following command:

CAT5KRSM(config)# ip http access−class 2

You can apply four types of authentication to HTTP access on a switch or router. Table 13.4 describes each of the four types of authentication.

Table 13.4: The four HTTP authentication types for a switch route processor or router.

268

To apply the authentication type, use the following command:

CAT5KRSM(config)# ip http authentication local

Note To disable the configured authentication type, use the no ip authentication command. To configure the username hsn with the password team, use the following command:

CAT5KRSM(config)# username hsn password team

You can provide an additional layer of protection when using Cisco’s IOS ClickStart software or the Cisco Web browser interface. To do so, change the default TCP access port 80 to port 50, or any port you plan to use. To set the TCP port to 50, use the following command:

CAT5KRSM(config)# ip http port 50

You can reset the HTTP TCP port to its default by using the following command:

CAT5KRSM(config)# no ip http 50

Enabling Port Security

To enable dynamic port security on a Set/Clear command−based switch for module 3 port 3, use the following command:

CAT5K>(enable) set port security 3/3 enable

Port 3/3 port security enabled with the learned mac address.

Trunking disabled for Port 3/3 due to Security Mode

To show a port configuration for port security, use the following show command:

CAT5K> (enable) show port 3/3

The output should look similar to this:

—————————————— ————————— ———— —————— —————— ————— ———————

Port Broadcast−Limit Broadcast−Drop

—————————————————— ——————————————

269

Last−Time−Cleared

——————————————————————————

Fri Dec 22 2000, 19:53:38

To enable static port security for module 1 port 3, manually specify the secure MAC address of the attached interface 00−15−20−4c−78−a1 using the following command:

CAT5K> (enable) set port security 3/1 enable 00−15−20−4c−78−a1 Port 3/1 port security enabled with 00−15−20−4c−78−a1

as the secure mac address CAT5K> (enable)

On a Cisco IOS command−based switch, you can use the port secure interface configuration command to enable addressing security. In Interface Configuration mode, to assign a port to allow only one MAC address, use the following command:

2924XL(config−if)# port secure max−mac−count 1

Tip You can assign max−mac−count a value between 1 and 132.

Displaying the MAC Address Table

Use the show mac−address−table command from Privileged EXEC Mode to display the MAC address table. Here is the command and syntax placement—Table 13.5 contains a description of each syntax element:

Table 13.5: The show mac−address−table command’s optional syntax descriptions.

show mac−address−table [static|dynamic|secure|self| aging−time|count]

[address hw−addr] [interface interface] [atm slot/port][vlan vlan−id]

The output from the show mac−address−table command should look like the following:

270

Tip You can use the no port secure command to disable addressing security or to set the maximum number of addresses allowed on the interface to the default value of 132.

271