- [Speaker 1] Another place we want to configure
passwords on a Cisco router is on our lines.
Modern iOS routers will contain three types of lines
generally speaking, and when we say lines,
we're simply referring to connection points
going into the router.
The CTY Line type
is the console port.
This is where you first connect to the router
right out of the box to begin
your initial configuration.
From there you can configure
secondary connection methods such as
Telnet or SSH Access,
and you can also configure initial addressing.
The AUX Line type is short for
the Auxiliary port.
You can think of this as a backup port,
and it's basically a secondary backup console port.
Now, these days they don't get a lot of use,
except for maybe in cases where you're locked
out of the router console port.
You might use the AUX port to gain access
in that situation.
And we have VTY Lines,
which are virtual terminal connections.
These are most commonly thought of as controlling
inbound Telnet connections.
The virtual part of the name refers to the fact
that these are software based lines.
That is to say, there is no physical hardware
associated with these lines,
as we would see with the console port, for example,
which has a physical console port connection.
All three of these types of lines can be
configured with password protection.
So let's connect to a router, and
take a look at how we can do that.
Now that I'm connected into a router,
if I say enable, and I give that enable password,
I can use the command: show line,
and from there we can see the
three types of lines found on my device.
We see the console port,
the CTY Line,
the AUX port,
or the Auxiliary port,
and we see several VTY Lines.
In my case, I have five VTY lines here.
Now, we can do this in a couple of ways,
we can configure a global password for a line,
that will be used by everyone,
or we can do user-specific passwords.
And we'll actually take a look at both methods here.
So first, let's go under
Global Configuration Mode,
and then we'll go under our Console Line
by saying Line, Console, Zero.
And from here we can set the password using
the command 'Password', and I'll make that
password 'Cisco', I'll just keep it simple
in this example,
and I'll hit enter.
The secondary command that we want to enter
is the command 'login'.
This is going to make sure that the
password checking feature is enabled
during login to the console.
So we can hit enter,
and I'll back out of that.
We'll do a show run,
I'll pipe to the section beginning with line,
so that we can see that section of the configuration
without scrolling through everything.
And you can see here,
under line con 0,
which is our console port,
we do have a password listed there now.
Notice that that is not a plain text password,
but that is an encrypted password.
That's because I previously enabled
the service Password Encryption command
on this router,
so that all of the passwords,
rather than being displayed in plain text,
those are using type 7 Cisco encryption for protection.
Now let's test that command
by exiting
I'm going to log out completely,
I'm going to hit enter,
and this time instead of taking me directly in,
you can see that it's prompting me
for a password.
So if I enter that password that I configured,
then it allows me access to the console,
just as I would expect.
Now that's the way to do that at a global level,
but what if we want to configure that for
user-specific passwords?
Well we can actually do that very easily,
so let's say enable again,
give our enable password,
and again I'm going to say 'show run pipe to
section beginning with line'
and what I'm looking for here is
I want to see exactly how many VTY Lines we have.
So you can see it says VTY 0 space 4.
We've already looked at the fact that we have
five VTY Lines here,
but we can see that these are 0-4.
That's the range of our VTY Lines,
so we can actually configure those
all at once for user-specific access
if we want to do that.
So we'll use that momentarily.
For now, let's go into
global configuration mode,
and if we're going to enable that,
at a per user level,
we need to configure some users locally,
on our router's database.
So we need to actually set up some users.
So I'll say username: Charles,
I'll use the keyword: secret,
because I want to use the stronger password option,
and I'll set that to security,
that'll be my password,
I'll make one more user.
Username: John,
secret, and I'll just make that one: router.
So now we have two different users configured.
We're still in global configuration mode.
So we can go under all of our VTY Lines simultaneously
and configure that by saying line VTY 0 space 4.
So now we're under VTY Line configuration mode
and we're going to affect all of those lines
at the same time instead of having to
configure those individually.
And now we can enable password checking by
saying login
local.
So this command is going to make sure that
when someone's trying to connect
over the VTY Line
it's going to prompt them for authentication,
and it's going to check that against the
local user database
that I have configured.
One of the popular ways that we
use those VTY Lines is through the
Telnet Protocol.
So let's actually test that,
we can test that fairly easily by
trying to Telnet into this router
from another host.
So let me jump over to a secondary host that I have.
So now that we're over there,
we're going to Telnet to 10 dot 1 dot 1 dot 1,
which is the interface IP address for router one
and you can see that it asks me for the username.
So I'll try Charles,
Password: Security.
And now notice
the command line prompt has changed to R1,
where that was previously PC.
So the Telnet session has successfully
connected and verified.
If I say logout,
it tells me that the connection is closed,
and I'm back to my normal command line.
So it looks like our VTY Line authentication method
worked just as we would want it to.
Now we can perform the exact same thing
for the AUX Lines.
Let me back out a level.
And now-- again-- you'll most likely
never use the AUX Line,
but just for completion's sake we'll
look at those commands.
They're very similar,
we're under global configuration mode,
so we'll say line AUX 0
and we'll say
password,
set it to let me in.
We'll hit enter,
and then again we want to use
the login keyword
to enable password checking during login,
just as we would for the initial console
configuration that we did.
So that's a look at how we can
protect a Cisco device from
unauthorized access to the command line interface,
by enabling password protection
for our lines.