Hackers Desk Reference

Usage Guidelines

This command first appeared in Cisco IOS Release 11.1.

DNS domains are specified with a leading dot (.) character; hostnames cannot begin with a dot (.) character. There can be multiple entries of this line.

A Kerberos realm consists of users, hosts, and network services that are registered to a Kerberos server. The Kerberos realm must be in uppercase letters. The router can be located in more than one realm at a time. Kerberos realm names must be in all uppercase characters.

Example

The following example illustrates the kerberos realm command:

kerberos realm .muruga.com MURUGA.COM

kerberos realm muruga.com MURUGA.COM

Related Commands

kerberos local-realm

kerberos server

kerberos srvtab entry

kerberos srvtab remote

[12.4.6] kerberos server

Use the kerberos server global configuration command to specify the location of the Kerberos server for a given Kerberos realm. Use the no form of this command to remove a Kerberos server for a specified Kerberos realm.

kerberos server kerberos-realm {hostname | ip-address} [port-number]

no kerberos server kerberos-realm {hostname | ip-address}

Syntax Description

hosts, and network services that are registered to a Kerberos server. The Kerberos realm must be in uppercase letters.

Command Mode

Global configuration

Usage Guidelines

This command first appeared in Cisco IOS Release 11.1.

Example

The following example specifies 126.38.47.66 as the Kerberos server for the Kerberos realm MURUGA.COM:

kerberos server MURUGA.COM 126.38.47.66

Related Commands

kerberos local-realm

kerberos realm

kerberos srvtab entry

kerberos srvtab remote

[12.4.7] kerberos srvtab entry

Use the kerberos srvtab remote global configuration command (not kerberos srvtab entry) to retrieve a SRVTAB file from a remoe host and automatically generate a Kerberos

SRVTAB entry configuration. (The Kerberos SRVTAB entry is the router's locally stored SRVTAB.) Use the no form of this command to remove a SRVTAB entry from the router's configuration.

kerberos srvtab entry kerberos-principle principle-type timestamp key-version number

key-type key-length encrypted-keytab

no kerberos srvtab entry kerberos-principle principle-type

Syntax Description

principle-type Version of the Kerberos SRVTAB.

private Data Encryption Standard (DES) key (if available) when you write out your configuration.

Command Mode

Global configuration.

Usage Guidelines

This command first appeared in Cisco IOS Release 11.2.

When you use the kerberos srvtab remote command to copy the SRVTAB file from a remote host (generally the KDC), it parses the information in this file and stores it in the router's running configuration in the kerberos srvtab entry format. The key for each SRVTAB entry is encrypted with a private DES key if one is defined on the router. To ensure that the SRVTAB is available (that is, that it does not need to be acquired from the KDC) when you reboot the router, use the write memory router configuration command to write the router's running configuration to NVRAM.

If you reload a configuration, with a SRVTAB encrypted with a private DES key, on to a router that does not have a private DES key defined, the router displays a message

informing you that the SRVTAB entry has been corrupted, and discards the entry.

If you change the private DES key and reload an old version of the router's configuration that contains SRVTAB entries encrypted with the old private DES keys, the router will restore your Kerberos SRVTAB entries, but the SRVTAB keys will be corrupted. In this case, you must delete your old Kerberos SRVTAB entries and reload your Kerberos SRVTABs on to the router using the kerberos srvtab remote command.

Although you can configure kerberos srvtab entry on the router manually, generally you would not do this because the keytab is encrypted automatically by the router when you copy the SRVTAB using the kerberos srvtab remote command.

Example

In the following example, host/new-router.loki.com@LOKI.COM is the host, 0 is the type, 817680774 is the timestamp, 1 is the version of the key, 1 indicates the DES is the encryption type, 8 is the number of bytes, and .cCN.YoU.okK is the encrypted key:

kerberos srvtab entry host/new-router.loki.com@LOKI.COM 0 817680774 1 1 8

.cCN.YoU.okK

Related Commands

kerberos srvtab remote

key config-key

[12.4.8] kerberos srvtab remote

Use the kerberos srvtab remote configuration command to retrieve a krb5 SRVTAB file from the specified host.

kerberos srvtab remote {hostname | ip-address} {filename}

Syntax Description

Command Mode

Configuration

Usage Guidelines

This command first appeared in Cisco IOS Release 11.2.

When you use the kerberos srvtab remote command to copy the SRVTAB file from the remote host (generally the KDC), it parses the information in this file and stores it in the router's running configuration in the kerberos srvtab entry format. The key for each SRVTAB entry is encrypted with the private Data Encryption Standard (DES) key if one is defined on the router. To ensure that the SRVTAB is available (that is, that it does not need to be acquired from the KDC) when you reboot the router, use the write memory configuration command to write the router's running configuration to NVRAM.

Example

The command in the following example copies the SRVTAB file residing on bucket.cisco.com to a router named scooter.cisco.com:

kerberos srvtab remote bucket.cisco.com scooter.cisco.com-new-srvtab

Related Commands

kerberos srvtab entry

key config-key

[12.4.9] key config-key

Use the key config-key global configuration command to define a private DES key for the router. Use the no form of this command to delete a private Data Encryption Standard (DES) key for the router.

key config-key 1 string

Syntax Description

string Private DES key (can be up to 8 alphanumeric characters).

Default

No DES-key defined.

Command Mode

Global configuration.

Usage Guidelines

This command first appeared in Cisco IOS Release 11.2.

This command defines for the router a private DES key that will not show up in the router configuration. This private DES key can be used to DES-encrypt certain parts of the router's configuration.

Caution The private DES key is unrecoverable. If you encrypt part of your configuration with the private DES key and lose or forget the key, you will not be able to recover the encrypted data.

Example

The command in the following example sets bubba as the private DES key on the router:

key config-key 1 bubba

Related Commands

kerberos srvtab entry

kerberos srvtab remote

[12.5.0] login tacacs

To configure your router to use TACACS user authentication, use the login tacacs line configuration command. Use the no form of this command to disable TACACS user authentication for a line.

login tacacs

no login tacacs

Syntax Description

This command has no arguments or keywords.

Default

Disabled

Command Mode

Line configuration

Usage Guidelines

This command first appeared in Cisco IOS Release 10.0.

You can use TACACS security if you have configured a TACACS server and you have a command control language (CCL) script that allows you to use TACACS security. For information about using files provided by Cisco Systems to modify CCL scripts to support TACACS user authentication, refer to the "Configuring AppleTalk Remote Access" chapter in the Access Services Configuration Guide.

Note This command cannot be used with AAA/TACACS+. Use the login authentication command instead.

Example

In the following example, lines 1 through 16 are configured for TACACS user authentication:

line 1 16

login tacacs

[12.5.1] nasi authentication

To enable TACACS+ authentication for NetWare Asynchronous Services Interface (NASI) clients connecting to a router, use the nasi authentication line configuration command. Use the no form of the command to return to the default, as specified by the aaa authentication nasi command.

nasi authentication {default | list-name}

no login authentication {default | list-name}

Syntax Description

Uses the default set with the aaa authentication nasi command.

Command Mode

Line configuration

Usage Guidelines

This command first appeared in Cisco IOS Release 11.1.

This command is a per-line command used with AAA authentication that specifies the name of a list of TACACS+ authentication methods to try at login. If no list is specified, the default list is used, even if it is specified in the command line. (You create defaults and lists with the aaa authentication nasi command.) Entering the no form of this command has the same effect as entering the command with the default argument.

Caution If you use a list-name value that was not configured with the aaa authentication nasi command, you will disable login on this line.

Before issuing this command, create a list of authentication processes by using the aaa authentication nasi global configuration command.

Examples

The following example specifies that the default AAA authentication be used on line 4:

line 4

nasi authentication default

The following example specifies that the AAA authentication list called list1 be used on line 7:

line 7

nasi authentication list1

Related Commands

A dagger (†) indicates that the command is documented outside this chapter.

aaa authentication nasi

ipx nasi-server enable †

show ipx nasi connections †

show ipx spx-protocol †

[12.5.2] ppp authentication

To enable Challenge Handshake Authentication Protocol (CHAP) or Password Authentication Protocol (PAP) or both and to specify the order in which CHAP and PAP authentication are selected on the interface, use the ppp authentication interface configuration command. Use the no form of the command to disable this authentication.

ppp authentication {chap | chap pap | pap chap | pap } [if-needed] [list-name | default]

[callin]

no ppp authentication Syntax Description

CHAP or PAP authentication if the user has already provided authentication. This option is available only on asychronous interfaces.

list-name (Optional) Used with AAA/TACACS+. Specifies the name of a list of TACACS+ methods of authentication to use. If no list name is specified, the system uses

the default. The list is created with the aaa authentication ppp command.

Caution If you use a list-name value that was not configured with the aaa authentication ppp command, you will disable PPP on this interface.

Default

PPP authentication is not enabled.

Command Mode

Interface configuration

Usage Guidelines

This command first appeared in Cisco IOS Release 10.0.

When you enable CHAP or PAP Authentication, or both, the local router requires the remote device to prove its identity before allowing data traffic to flow. PAP Authentication requires the remote device to send a name and password, which is checked against a matching entry in the local username database or in the remote TACACS/TACACS+ database. CHAP Authentication sends a Challenge to the remote device. The remote device encrypts the challenge value with a shared secret and returns the encrypted value and its name to the local Router in a Response message. The local router attempts to match the remote device's name with an associated secret stored in the local username or remote TACACS/TACACS+ database; it uses the stored secret to encrypt the original challenge and verify that the encrypted values match.

You can enable PAP or CHAP, or both, in either order. If you enable both methods, the first method specified is requested during link negotiation. If the peer suggests using the second method, or refuses the first method, the second method is tried. Some remote devices support only CHAP, and some support only PAP. Base the order in which you specify methods on the remote device's ability to correctly negotiate the appropriate method, and on the level of data line security you require. PAP usernames and passwords are sent as cleartext strings, which can be intercepted and reused. CHAP has eliminated most of the known security holes.

Enabling or disabling PPP authentication does not affect the local router's willingness to authenticate itself to the remote device.

If you are using autoselect on a TTY line, you probably want to use the ppp