5.2Device access control and AAA

If the network device itself is taken over, all the traffic it was protecting is put at risk. That is why hardening management access to routers/switches is a top-priority control. This section builds the judgment to decide "what suffices at small scale" versus "what is needed at large scale or under audit requirements," from local password configuration on a single device up to AAA (authentication, authorization, and accounting via external servers) that centrally manages many devices.

5.2.1Local passwords and SSH

• Protect privileged EXEC mode (enable) with enable secret. enable secret is stored hashed (type 5 by default, type 8/9 scrypt on newer IOS) so the plaintext cannot be recovered. The legacy enable password is not encrypted and is weak, so do not use it. Note that service password-encryption, which weakly obscures line passwords as type 7, is reversible and provides no real protection.
• On the console (line console 0) and the VTY lines (line vty 0 4, the virtual lines for Telnet/SSH), set password plus login, or login local (authenticating against the local database of username/secret). Use username NAME secret PASSWORD to create per-user accounts (secret—hashed storage—is safer than password).
• Because Telnet sends the username, password, and commands in plaintext, always use SSH for remote management. Enabling SSH requires (1) setting a hostname and domain name, (2) generating an RSA key with crypto key generate rsa, (3) creating a local user, and (4) specifying transport input ssh under line vty. SSHv2 is recommended.