6.3. Device Access Control

💡 First Principle: Network devices are high-value targets—compromising a router or switch gives attackers control over traffic flows, visibility into communications, and a pivot point for further attacks. Think of it like keys to the building: if someone gets the master key, every room is accessible.

Consider this nightmare scenario: An attacker gains enable access to your core router. Now imagine what they can do: inspect all traffic flowing through the device, redirect traffic to malicious servers for credential harvesting, create backdoor accounts that persist through reboots, disable security logging to cover their tracks. One compromised router can take down an entire organization.

What happens with default configurations: Out of the box, Cisco devices have no enable password, console access requires no authentication, and VTY lines may allow Telnet (unencrypted). Leaving defaults is like leaving your front door unlocked while posting your address online. The first task on any new device is securing management access.

The principle of least privilege: Give users only the access they need. A help desk technician doesn't need enable access on core routers. An auditor needs read-only access, not configuration rights. Privilege levels and role-based access control enforce these boundaries. IOS privilege levels run 0–15: level 1 is user EXEC (> prompt, monitoring only), level 15 is privileged EXEC with every command (# prompt), levels 2–14 can be customized, and level 0 permits only a few commands such as enable, disable and logout.

Local Password Configuration:

Router(config)# enable secret SecurePassword123!
Router(config)# line console 0
Router(config-line)# password ConsolePass!
Router(config-line)# login
Router(config-line)# exec-timeout 5 0                ! Idle logout: 5 minutes, 0 seconds
Router(config)# line vty 0 15
Router(config-line)# password VTYPass!
Router(config-line)# login

Better: Local Username/Password:

Router(config)# username admin privilege 15 secret AdminPass123!
Router(config)# line console 0
Router(config-line)# login local
Router(config)# line vty 0 15
Router(config-line)# login local

login local prompts for a username and password and checks them against the username entries; plain login checks only the line password. Restricting the lines to SSH (transport input ssh) is a separate command—see 3.8.

Password Encryption:

Router(config)# service password-encryption    ! Type 7 (weak, reversible)
! Covers `password` entries such as console and VTY lines.
! It does NOT re-encrypt `enable secret`, which is already hashed.

enable secret vs enable password: enable secret stores a one-way hash (type 5 MD5 on older IOS, type 8/9 on newer releases); enable password is stored in clear text (type 0), or as reversible type 7 once service password-encryption is on. If both are configured, enable secret wins.

A hardening order that never locks you out: set credentials first (enable secret, local users); then lock down management access (SSH only, VTY ACL); then shrink the attack surface (disable unused services, shut unused ports); finally send logs to syslog and sync clocks with NTP so every event carries a trustworthy timestamp.