5.2 Device Access Control and Password Policies

Securing the Privileged-EXEC Password

The single most-tested device-access fact: use enable secret, never enable password. The secret form stores a one-way hash; the password form stores clear text or trivially reversible Type 7.

If both are configured, the enable secret value always takes priority and the enable password is effectively dead.

Cisco Password Types

Know the type numbers — the exam shows a hash prefix and asks how strong it is.

service password-encryption upgrades clear Type 0 entries to Type 7 in the running config. Because Type 7 is reversible (free decoders exist online), treat it as a screen against casual shoulder-surfing — not real protection.

Router(config)# enable secret StrongP@ss123        ! Type 9 on modern IOS
Router(config)# service password-encryption          ! Masks remaining Type 0 passwords
Router(config)# username admin secret StrongP@ss123  ! Local user, hashed

Securing the Console Line

Router(config)# line console 0
Router(config-line)# password ConsolePass123
Router(config-line)# login                ! Require the line password
Router(config-line)# exec-timeout 5 0    ! Logout after 5 min idle
Router(config-line)# logging synchronous  ! Stop log msgs from scrambling input

Securing the VTY Lines (Remote Access)

VTY lines handle Telnet/SSH. The exam wants SSH-only with a local or AAA login.

Router(config)# ip domain-name example.com
Router(config)# crypto key generate rsa modulus 2048   ! Required before SSH
Router(config)# ip ssh version 2
Router(config)# line vty 0 15
Router(config-line)# transport input ssh   ! Blocks clear-text Telnet
Router(config-line)# login local            ! Use local username database
Router(config-line)# exec-timeout 10 0
Router(config-line)# access-class 10 in      ! ACL restricts source IPs

Key requirements for SSH to even start: a hostname, an IP domain name, and an RSA key (≥768-bit modulus, 2048 recommended). Forgetting the domain name or key is the classic "SSH won't work" troubleshooting trap.

Throttling Brute-Force Logins

Router(config)# login block-for 120 attempts 3 within 60

This blocks all logins for 120 seconds after 3 failed attempts within 60 seconds, defeating dictionary attacks against the VTY lines.

AAA: Authentication, Authorization, Accounting

Authentication Methods, Not Just Passwords

Authentication can rest on three broad evidence types, and AAA can chain them. Passwords (something you know) are the baseline but the weakest alone. Certificates and tokens (something you have) bind the login to a device or hardware key. Biometrics (something you are) tie it to the person. Strong device-access designs combine a hashed local credential with a centralized AAA server and, increasingly, a second factor. This is where AAA authentication meets the multi-factor concept covered later in this chapter.

TACACS+ vs. RADIUS

This comparison is almost guaranteed on the exam.

On the Exam: Pick TACACS+ when the scenario is controlling which commands an admin can run (full-packet encryption + per-command authZ). Pick RADIUS when it is user network access such as 802.1X or wireless. Memorize ports: TACACS+ = TCP 49; RADIUS = UDP 1812/1813.

Privilege Levels and Local Fallback

IOS supports sixteen privilege levels, 0 through 15. Level 1 is normal user EXEC (the > prompt), level 15 is full privileged EXEC (the # prompt), and levels 2 through 14 are custom tiers you assign specific commands to. A read-only help-desk role typically lives at level 1, while a senior engineer needs level 15.

When you deploy centralized AAA, always keep a local fallback so a RADIUS/TACACS+ outage does not lock everyone out. The classic pattern tries the server group first and the local database second:

Router(config)# aaa new-model
Router(config)# aaa authentication login default group tacacs+ local
Router(config)# username admin privilege 15 secret StrongP@ss123

If the TACACS+ servers are unreachable, the router falls back to the local admin account. Omitting the local keyword is an outage waiting to happen and a tempting wrong answer on the exam. Remember that aaa new-model must be enabled before any AAA command takes effect, and that turning it on immediately changes the default login behavior on every line.