Vty Password

The vty lines allow access to a router via Telnet. By default, many Cisco devices support five VTY lines that are numbered 0 to 4. A password needs to be set for all available vty lines. The same password can be set for all connections. However, it is often desirable that a unique password be set for one line to provide a fall-back for administrative entry to the device if the other connections are in use.

The following commands are used to set a password on vty lines:

Router(config)#line vty 0 4 Router(config-line)#password password Router(config-line)#login

By default, the IOS includes the login command on the VTY lines. This prevents Telnet access to the device without first requiring authentication. If, by mistake, the no login command is set, which removes the requirement for authentication, unauthorized persons could connect to the line using Telnet. This would be a major security risk.

Encrypting Password Display

Another useful command prevents passwords from showing up as plain text when viewing the configuration files. This is the service password-encryption command.

This command causes the encryption of passwords to occur when a password is configured. The service password-encryption command applies weak encryption to all unencrypted passwords. This encryption does not apply to passwords as they are sent over media only in the configuration. The purpose of this command is to keep unauthorized individuals from viewing passwords in the configuration file.

If you execute the show running-config or show startup-config command prior to the service password-encryption command being executed, the unencrypted passwords are visible in the configuration output. The service password-encryption can then be executed and the encryption will be applied to the passwords. Once the encryption has been applied, removing the encryption service does not reverse the encryption.

Page 3:

Banner Messages

Although requiring passwords is one way to keep unauthorized personnel out of a network, it is vital to provide a method for declaring that only authorized personnel should attempt to gain entry into the device. To do this, add a banner to the device output.

Banners can be an important part of the legal process in the event that someone is prosecuted for breaking into a device. Some legal systems do not allow prosecution, or even the monitoring of users, unless a notification is visible.

The exact content or wording of a banner depends on the local laws and corporate policies. Here are some examples of information to include in a banner:

• "Use of the device is specifically for authorized personnel."

• "Activity may be monitored."

• "Legal action will be pursued for any unauthorized use."

Because banners can be seen by anyone who attempts to log in, the message must be worded very carefully. Any wording that implies that a login is "welcome" or "invited" is not appropriate. If a person disrupts the network after gaining unauthorized entry, proving liability will be difficult if there is the appearance of an invitation.

The creation of banners is a simple process; however, banners should be used appropriately. When a banner is utilized it should never welcome someone to the router. It should detail that only authorized personnel are allowed to access the device. Further, the banner can include scheduled system shutdowns and other information that affects all network users.

The IOS provides multiple types of banners. One common banner is the message of the day (MOTD). It is often used for legal notification because it is displayed to all connected terminals.

Configure MOTD using the banner motd command from global mode.

As shown in the figure, the banner motd command requires the use of delimiters to identify the content of the banner message. The banner motd command is followed by a space and a delimiting character. Then, one or more lines of text are entered to represent the banner message. A second occurrence of the delimiting character denotes the end of the message. The delimiting character can be any character as long as it does not occur in the message. For this reason, symbols such as the "#" are often used.

To configure a MOTD, from global configuration mode enter the banner motd command:

Switch(config)#banner motd # message #

Once the command is executed, the banner will be displayed on all subsequent attempts to access the device until the banner is removed.

Page 4:

In this activity, you will use Packet Tracer to practice the IOS commands for setting passwords and banners on switches and routers.

Click the Packet Tracer icon to launch the Packet Tracer activity.