HTTP Access

16 Mar

HTTP Access
Cisco IOS software on routers is equipped with a Web browser user interface that allows you to issue commands into the router via the Web interface. The Web browser user interface can be customized and tailored to your business environment. The HTTP server is disabled by default; when it’s enabled, it introduces some new security vulnerabilities into your network. The HTTP server function, when it’s enabled, gives all client devices with logical connectivity to the router the ability to monitor or modify the configuration of the router. All that needs to reside on the client is a software package that interprets packets on port 80. This is obviously a major security issue.

However, the router software allows you to change the default port that the HTTP server is running on. You can also configure an access list of specific hosts that are allowed Web access to the router and apply the access list to the HTTP server. Authentication of each user provides better security if you elect to use the router’s HTTP server functions. Authentication can take place by one of four different methods:

AAA—Indicates that the AAA function is used for authentication.
Enable—Indicates that the configured enable password is used for authentication. This is the default authentication method.
Local—Indicates that the locally configured security database is used for authentication.
TACACS+—Indicates that the Terminal Access Controller Access system is used for authentication.

Immediate Solutions
Configuring Console Security

The console port is used to attach a terminal directly into the router. By default, no security is applied to the console port and the setup utility does not prompt you to configure security for console access. Cisco routers have many different modes of operation, one of which is user mode. When you first access the router via the console port, the router will prompt you for a password, if one has been configured. After successfully supplying the password, you are logged into user mode on the router. When a Cisco router is in user mode, the router will display its hostname followed by the greater than symbol. Here is an example of user mode access:

SecureRouter>
User mode has limited functionality. Enable mode, also called privileged mode, can be accessed by typing the enable command. If passwords have been configured to access this level of the IOS, the router prompts you for the correct password. When a Cisco router is in enable mode, the router will display its hostname followed by the pound sign. Here is an example of enable mode access:

SecureRouter#

Cisco passwords are case sensitive. The simplest and most direct way to connect to the network device is to use a direct connection to the console port of a router or switch. You can configure a console password to authenticate users for user mode access by entering the following commands:

SecureRouter#config t
Enter configuration commands, one per line. End with CNTL/Z.
SecureRouter(config)#line con 0
SecureRouter(config−line)#password Coriolis
SecureRouter(config−line)#login
SecureRouter(config−line)#end

The preceding configuration sets the user mode password to Coriolis. Cisco routers also maintain a local user authentication database, which can be used to authenticate users who connect directly to the console port of a router. Here’s an example of configuring the router to use the local user database for authentication of users who attempt to access the router via the console:

!
username Fred privilege 15 password 0 Flintstone
username Elroy privilege 12 password 0 Jetson
username Captain privilege 8 password 0 Kirk
!
line con 0
login local
transport input none
!

The preceding configuration defines three users: Fred, Elroy, and Captain. Each user has an associated privilege level defined for their respective login credentials and has a password that is associated with their username. This allows Fred to log into the router with a username of Fred and a password of Flintstone. Because Fred’s privilege level defines the maximum privilege level that can be configured on the router, Fred is considered to be the super−user. Elroy has a privilege level of 12 and the password Jetson.

Note Assignment of privilege levels is discussed in detail later in this chapter.

By assigning Elroy a privilege of 12, the administrator can limit the functionality that Elroy may have on the router. That’s also the case for Captain. When a user plugs into the console port of a router configured with local authentication, they are first prompted for their username; after successfully passing the correct username to the router, they are then prompted for the password that is associated with that username. The following example details these steps:

User Access Verification

Username: Fred
Password: Flintstone
SecureRouter#

Now, what do you think would happen if you were to attempt to log in with the username of Fred and the password that is associated with Elroy? You would suspect that the router would deny you access. This example details this attempt:

User Access Verification

Username: Fred
Password: Jetson
% Login invalid
Username:

From this, you can see that you must supply the password that is associated with the username with which you are attempting to gain access.

Warning When using local authentication and assigning privilege levels, you must be careful to associate the correct username with the correct privilege level.
Anyone who logs in with a privilege level that is equal to 2 or above is logged directly into privileged mode.

Configuring Telnet Security
Directly connecting to the console of a router is generally a relatively easy method for gaining access to the device; however, this method is inconvenient and not abundantly scalable. If console access is the only method available to gain access into the device, an administrator must always walk, drive, or fly to the physical location of the router and plug into the device’s console port. Fortunately, there are methods for gaining access into the router from a remote location. The most common method of remote administration for a Cisco router is to use a Telnet session. Unlike with console access, there are four configuration requirements that must be met before you can use this  method of access:

-An enable password must be supplied. This is discussed in the next section.
-The router must have an IP address assigned to a routable interface.
-The routing table of the router must contain a route for the source of the Telnet packet.
-Under line configuration mode, a vty password must be supplied.

The steps involved in defining Telnet security are similar to the steps used to configure console security. An example of configuring the fourth requirement (after the first three have been met) can be seen here:

SecureRouter#config t
Enter configuration commands, one per line. End with CNTL/Z.
SecureRouter(config)#line vty 0 4
SecureRouter(config−line)#login
SecureRouter(config−line)#password letmein
SecureRouter(config−line)#end
SecureRouter#

As mentioned in the preceding section, “Configuring Console Security,” Cisco routers also maintain a local user authentication database, which can be used to authenticate users who directly connect to the console port of a router. Here is an example of configuring the router to use the local user database for authentication of users who attempt to access the router via the console:

!
username Fred privilege 15 password 0 Flintstone
username Elroy privilege 12 password 0 Jetson
username Captain privilege 8 password 0 Kirk
!
line vty 0 4
login local

The result is that, when a user telnets to the router with this configuration, they will be prompted to enter a username and password before being allowed to gain access into the router.

Routers can also restrict Telnet access to authorized users with the use of an access list. The access list is then applied to the virtual terminal ports of the router with the access−class command. This allows you to restrict Telnet access from a particular IP address or a subnet of IP addresses. Use the following steps to this method of security:

1.Use the access−list global configuration command to configure an access list that permits the specific hosts that are allowed Telnet access.

2.Use the access−class access−list−number {in|out} command to apply the access list to the virtual terminal ports.

In the following example, the router is configured to allow only three hosts Telnet access on each of the available virtual terminal ports:

Router−A#config t
Enter configuration commands, one per line. End with CNTL/Z.
Router−A(config)#access−list 10 permit 10.10.10.19
Router−A(config)#access−list 10 permit 10.10.11.20
Router−A(config)#access−list 10 permit 10.10.12.130
Router−A(config)#line vty 0 4
Router−A(config−line)#access−class 10 in
Router−A(config−line)#end
Router−A#

Note Remember, console and Telnet security is not preconfigured for you by default. One of your first configuration steps when you initially set up your router should be to configure each of these interfaces.

Random Posts

No comments yet

Leave a Reply

You must be logged in to post a comment.