Securing Console and VTY Access with Local Authentication

1. The Foundation: Local User Authentication

By default, a new Cisco device doesn't require any credentials for console access. This is a major security risk. While you can set a simple, shared password for a login line, this method is weak and lacks accountability. A much better practice is to create a local database of individual user accounts on the device itself.

This approach offers two key advantages:

• Accountability: You can see who is logged in (show users) and potentially log actions to a specific user.
• Granularity: You can assign different privilege levels to different users (though we'll focus on the primary admin access for now).

To get a clear understanding of the concepts of lines, local user authentication, and the crucial difference between the password and secret commands when creating users, please read the following sections from the "Lines and local user authentication" article.

The primary command to create a user is:
Switch(config)# username <your-username> secret <your-strong-password>

2. Securing the Console Port

The console port provides direct physical access to the device's command-line interface (CLI). It's your primary entry point for initial configuration and emergency recovery. Leaving it unsecured means anyone with a console cable can access your device.

To secure it, you'll instruct the console line (line console 0) to use the local user database for authentication. The video below demonstrates exactly how to do this.

The core configuration looks like this:

! First, create a user in global config mode
R1(config)# username admin secret MyS3cureP@ss!

! Then, configure the console line
R1(config)# line console 0
R1(config-line)# login local
R1(config-line)# exec-timeout 5 0  ! Sets a 5-minute inactivity timeout

3. Securing VTY Lines for Remote Access

Virtual Teletype (VTY) lines are used for remote management access via protocols like Telnet and SSH. Since your degree focuses on security, you know that Telnet is insecure because it sends all data, including passwords, in plaintext. Therefore, you should always enforce the use of SSH (Secure Shell), which encrypts the entire session.

Similar to the console, you will configure the VTY lines to use the local user database. The process is nearly identical, but with one extra crucial step: specifying SSH as the only allowed transport protocol.

The following video provides a concise summary of all the steps needed for a secure SSH setup, including the VTY line configuration.

The VTY configuration is as follows:

! Assuming a user is already created
! Configure all 16 VTY lines (0 through 15)
R1(config)# line vty 0 15
R1(config-line)# login local
R1(config-line)# transport input ssh  ! This is critical - it disables Telnet
R1(config-line)# exec-timeout 5 0

4. Practical Lab: Configuration and Verification

Now it's time to put this all together. The following video is a short, guided lab that walks you through creating users and securing the console line with login local. Follow along to solidify your understanding of the process and the result.

After configuring device access, you must verify that it works as expected. Here are the most important commands to use:

• show running-config | section username: Displays all the local user accounts created on the device. Verify that the passwords are encrypted (they will be if you used the secret keyword).
• show running-config | section line: Shows the configuration for all lines (console, VTY, aux). Use this to confirm that login local and transport input ssh are correctly applied.
• show users: Displays who is currently logged into the device and via which line. This is useful for active monitoring.

For a quick reference on these commands and common mistakes to avoid, review the final sections of the "Lines and local user authentication" article.

Conclusion

Congratulations on completing this final lesson! You have now mastered a fundamental aspect of network device security: controlling administrative access. By replacing insecure, shared passwords with individual local user accounts, you enhance both security and accountability.

Key Takeaways:

• Use Local Users: Always create individual user accounts with the username <name> secret <password> command for secure, accountable management.
• Secure All Lines: Apply the login local command to both line console 0 and line vty 0 15 to enforce authentication against the local user database.
• Enforce SSH: On VTY lines, always use transport input ssh to disable insecure Telnet and ensure all remote management traffic is encrypted.
• Use Timeouts: Configure exec-timeout on all lines to protect against sessions being left open on unattended terminals.
• Verify Your Work: Use show running-config and show users to confirm your security settings are active and correct.

Over the past set of lessons, you've covered a range of critical CCNA topics, from Layer 2 switching and VLANs to essential security features like port security, DHCP snooping, and now device access control. This knowledge provides a solid practical foundation for the hands-on project you are working on. Good luck