Cisco IOS XE: Управление доступом к коммутатору с помощью паролей и уровней привилегий - руководство по эксплуатации (EN)

Restrictions for Controlling Switch Access with Passwords and Privileges

Controlling Switch Access with Passwords and Privilege Levels Restrictions for Controlling Switch Access with Passwords and Privileges, on page 1 Information About Controlling Switch Access with Passwords and Privileges, on page 2 How to Configure Switch Access with Passwords and Privileges, on page 6 Monitoring Switch Access with Passwords and Privileges, on page 16 Configuration Examples for Switch Access with Passwords and Privilege Levels, on page 16 Feature History for Controlling Switch Access with Passwords and Privileges, on page 17 Restrictions for Controlling Switch Access with Passwords and Privileges The following are the restrictions for controlling switch access with passwords and privileges:

• Disabling password recovery will not work if you have set the switch to boot up manually by using the boot manual global configuration command. This command produces the boot loader prompt ( switch: ) after the switch is power cycled. • Password validation for the enable password command against the common criteria policy does not happen during configuration or reconfiguration of the aaa common-criteria policy command. The password is validated against the common criteria policy only during configuration or reconfiguration of the enable common-criteria-policy command.

In a high availability setup, if the active device is reloaded and then one of the criterion under the AAA common criteria policy associated with the enable password configuration is changed (such that the password no longer satisfies the common criteria policy) at a time instance between the manual reload of the active device and selection of the standby switch, the enable password configuration on the standby device fails during bulk sync, while the enable password configuration continues to exist on the active device. This configuration mismatch between the active and the standby devices triggers continuous reload of the standby device.

We recommend that you do not modify the common criteria policy at a time instance between the manual reload of the active device and the standby switch selection. Controlling Switch Access with Passwords and Privilege Levels 1

Стр. 1

Information About Controlling Switch Access with Passwords and Privileges

Restrictions and Guidelines for Reversible Password Types • Password type 0 and 7 are replaced with password type 6. So password type 0 and 7, which were used for administrator login to the console, Telnet, SSH, webUI, and NETCONF must be migrated to password type 6. No action is required if username and password are type 0 and 7 for local authentication such as CHAP, EAP, and so on. • If the startup configuration has a type 6 password and you downgrade to a version in which type 6 password is not supported, you can/may be locked out of the device.

Restrictions and Guidelines for Irreversible Password Types • Username secret password type 5 and enable secret password type 5 must be migrated to the stronger password type 8 or 9. For more information, see Protecting Enable and Enable Secret Passwords with Encryption, on page 7 . • If the startup configuration of the device has convoluted type 9 secret (password that starts with $14$), then a downgrade can only be performed to a release in which the convoluted type 9 secret is supported. Convoluted type 9 secret is supported in Cisco IOS XE Gibraltar 16.11.2 and later releases.

If the startup configuration has a convoluted type 9 secret, and you downgrade to a release prior to Cisco IOS XE Gibraltar 16.11.2, you can/may be locked out of the device. Before you downgrade to any release in which convoluted type 9 secret is not supported, ensure that the type 9 secret (password that starts with $9$) must be part of the startup configuration instead of convoluted type 9 secret (password that starts with $14$) or type 5 secret (password that starts with $1$).

If a device is upgraded from Cisco IOS XE Fuji 16.9.x, Cisco IOS XE Gibraltar 16.10.x, or Cisco IOS XE Gibraltar 16.11.x to Cisco IOS XE Gibraltar 16.12.x, the type 5 secret is auto-converted to convoluted type 9 secret (password that starts with $14$). For example: username user1 secret 5 $1$dNmW$7jWhqdtZ2qBVz2R4CSZZC0 is auto-converted to username user1 secret 9 $14$dNmW$QykGZEEGmiEGrE$C9D/fD0czicOtgaZAa1CTa2sgygi0Leyw3/cLqPY426 . After the device is upgraded, run the write memory command in privileged EXEC mode for the convoluted type 9 secret to be permanently written into the startup configuration. • Plain text passwords are converted to nonreversible encrypted password type 9.

This is supported in Cisco IOS XE Gibraltar 16.10.1 and later releases. Note • Secret password type 4 is not supported. Information About Controlling Switch Access with Passwords and Privileges This section provides information about controlling switch access with passwords and privileges. Controlling Switch Access with Passwords and Privilege Levels Restrictions and Guidelines for Reversible Password Types Controlling Switch Access with Passwords and Privilege Levels 2

Стр. 2

Additional Password Security

Preventing Unauthorized Access You can prevent unauthorized users from reconfiguring your switch and viewing configuration information. Typically, you want network administrators to have access to your switch while you restrict access to users who dial from outside the network through an asynchronous port, connect from outside the network through a serial port, or connect through a terminal or workstation from within the local network. To prevent unauthorized access into your switch, you should configure one or more of these security features: • At a minimum, you should configure passwords and privileges at each switch port. These passwords are locally stored on the switch.

When users attempt to access the switch through a port or line, they must enter the password specified for the port or line before they can access the switch. • For an additional layer of security, you can also configure username and password pairs, which are locally stored on the switch. These pairs are assigned to lines or ports and authenticate each user before that user can access the switch. If you have defined privilege levels, you can also assign a specific privilege level (with associated rights and privileges) to each username and password pair.

• If you want to use username and password pairs, but you want to store them centrally on a server instead of locally, you can store them in a database on a security server. Multiple networking devices can then use the same database to obtain user authentication (and, if necessary, authorization) information. • You can also enable the login enhancements feature, which logs both failed and unsuccessful login attempts. Login enhancements can also be configured to block future login attempts after a set number of unsuccessful attempts are made.

Default Password and Privilege Level Configuration A simple way of providing terminal access control in your network is to use passwords and assign privilege levels. Password protection restricts access to a network or network device. Privilege levels define what commands users can enter after they have logged into a network device. This table shows the default password and privilege level configuration. Table 1: Default Password and Privilege Levels Additional Password Security The following sections provide information about unmasked and masked secret password.

Controlling Switch Access with Passwords and Privilege Levels Preventing Unauthorized Access Feature Default Setting Enable password and privilege level No password is defined. The default is level 15 (privileged EXEC level). The password is not encrypted in the configuration file. Enable secret password and privilege level No password is defined. The default is level 15 (privileged EXEC level). The password is encrypted before it is written to the configuration file. Line password No password is defined. Controlling Switch Access with Passwords and Privilege Levels 3

Стр. 3

Password Recovery

Unmasked Secret Password To provide an additional layer of security, particularly for passwords that cross the network or that are stored on a Trivial File Transfer Protocol (TFTP) server, you can use either the enable password or enable secret global configuration commands. Both commands accomplish the same thing; that is, you can establish an encrypted password that users must enter to access privileged EXEC mode (the default) or any privilege level you specify. We recommend that you use the enable secret command because it uses an improved encryption algorithm.

If you configure the enable secret command, it takes precedence over the enable password command; the two commands cannot be in effect simultaneously. For a device that loads with no start-up configuration, the Enable Secret Password task is a mandatory configuration whether you select Yes or No at the "Would you like to enter the initial configuration dialog?" prompt of the initial configuration wizard. The configured password must contain a minimum of 10 and a maximum of 32 characters. It must also include a minimum of one uppercase letter, one lowercase letter, and one numeral. Additionally, the term 'cisco' must not be part of the password.

In some cases where the device is connected to the internet, Cisco Plug and Play (PnP) can terminate the initial configuration wizard. In such cases, the enable secret configuration will not be prompted. Note If you enable password encryption, it applies to all passwords including username passwords, authentication key passwords, the privileged command password, and console and virtual terminal line passwords. Masked Secret Password With enable secret command, password is encrypted but is visible on the terminal when you type the password. To mask the password on the terminal, use the masked-secret global configuration command. The encryption type for this password is type 9, by default.

You can use this command to configure masked secret password for common criteria policy. Password Recovery By default, any end user with physical access to the switch can recover from a lost password by interrupting the boot process while the switch is powering on and then by entering a new password. The password-recovery disable feature protects access to the switch password by disabling part of this functionality. When this feature is enabled, the end user can interrupt the boot process only by agreeing to set the system back to the default configuration.

With password recovery disabled, you can still interrupt the boot process and change the password, but the configuration file (config.text) and the VLAN database file (vlan.dat) are deleted. If you disable password recovery, we recommend that you keep a backup copy of the configuration file on a secure server in case the end user interrupts the boot process and sets the system back to default values. Do not keep a backup copy of the configuration file on the switch. If the switch is operating in VTP transparent mode, we recommend that you also keep a backup copy of the VLAN database file on a secure server.

When the switch is returned to the default system configuration, you can download the saved files to the switch by using the Xmodem protocol. To re-enable password recovery, use the no system disable password recovery switch number | all global configuration command. Controlling Switch Access with Passwords and Privilege Levels Password Recovery Controlling Switch Access with Passwords and Privilege Levels 4

Стр. 4