Securing Remote Management and Disabling Unnecessary Services

Nerd Cafe

Objective:

Configure a Cisco router to ensure secure remote management and minimize exposure to potential threats by disabling unused services.

Topology Diagram:

Topology

Step 1: Configure Secure Remote Access

• Set the Router's Hostname and Domain Name:

R1#configure terminal
R1(config)#hostname RO-nerd-cafe
RO-nerd-cafe(config)#ip domain-name nerd-cafe.ir
RO-nerd-cafe(config)#

• Generate RSA Key Pair for SSH:

RO-nerd-cafe(config)#crypto key generate rsa
The name for the keys will be: RO-nerd-cafe.nerd-cafe.ir
Choose the size of the key modulus in the range of 360 to 4096 for your
  General Purpose Keys. Choosing a key modulus greater than 512 may take
  a few minutes.

How many bits in the modulus [512]: 2048
% Generating 2048 bit RSA keys, keys will be non-exportable...
[OK] (elapsed time was 2 seconds)

RO-nerd-cafe(config)#
*Mar 31 07:27:49.995: %SSH-5-ENABLED: SSH 1.99 has been enabled
RO-nerd-cafe(config)#

Note: A key modulus of 2048 bits is recommended for stronger encryption.​

• Configure VTY Lines for SSH Access Only:

RO-nerd-cafe(config)#line vty 0 4
RO-nerd-cafe(config-line)#transport input ssh
RO-nerd-cafe(config-line)#exit
RO-nerd-cafe(config)#

• Create an Access Control List (ACL) to Restrict Management Access:

RO-nerd-cafe(config)#access-list 10 permit 192.168.202.0 0.0.0.255

Explanation: This ACL permits access only from the 192.168.202.0/24 network. Adjust the IP range as per your management network.

• Apply the ACL to VTY Lines:

RO-nerd-cafe(config)#line vty 0 4
RO-nerd-cafe(config-line)#access-class 10 in
RO-nerd-cafe(config-line)#exit
RO-nerd-cafe(config)#

Step 2: Configure Session Management

• Set an EXEC Timeout for Idle Sessions:

RO-nerd-cafe(config)#line vty 0 4
RO-nerd-cafe(config-line)#exec-timeout 10 0
RO-nerd-cafe(config-line)#exit
RO-nerd-cafe(config)#

Explanation: This configuration disconnects idle sessions after 10 minutes.​

• Disable the Auxiliary (AUX) Port:

RO-nerd-cafe(config)#line aux 0
RO-nerd-cafe(config-line)#transport input none
RO-nerd-cafe(config-line)#exit
RO-nerd-cafe(config)#

Explanation: Disabling the AUX port prevents unauthorized access via modem connections.​

Step 3: Configure Login and EXEC Banners

• Set the Login Banner:

RO-nerd-cafe(config)#banner login ^C
Enter TEXT message.  End with the character '^'.
Unauthorized access is prohibited. All activities are monitored.
^C
RO-nerd-cafe(config)#

Explanation: The ^C is a delimiter; you can use any character not present in the banner text.

• Set the EXEC Banner:

RO-nerd-cafe(config)#banner exec ^C
Enter TEXT message.  End with the character '^'.
Welcome to SecureRouter. Authorized users only.
^C
RO-nerd-cafe(config)#

Step 4: Disable Unnecessary Services

• Disable HTTP and HTTPS Servers:

RO-nerd-cafe(config)#no ip http server
RO-nerd-cafe(config)#no ip http secure-server

Explanation: Disabling these services prevents web-based management interfaces, which can be security risks if not properly secured.

• Disable Identification Service:

RO-nerd-cafe(config)#no ip identd

Explanation: The Identification Protocol can provide unnecessary information to potential attackers.

• Disable BOOTP Server:

RO-nerd-cafe(config)#no ip bootp server

Explanation: BOOTP is rarely used and can be disabled to reduce potential attack vectors.

• Disable Proxy ARP on Interfaces:

RO-nerd-cafe(config)#interface fastEthernet 0/0
RO-nerd-cafe(config-if)#no ip proxy-arp
RO-nerd-cafe(config-if)#exit
RO-nerd-cafe(config)#interface fastEthernet 1/0
RO-nerd-cafe(config-if)#no ip proxy-arp
RO-nerd-cafe(config-if)#exit
RO-nerd-cafe(config)#

Explanation: Disabling Proxy ARP prevents the router from answering ARP queries on behalf of other devices, enhancing security.

Verification:

• Check SSH Configuration:

RO-nerd-cafe#show ip ssh
SSH Enabled - version 1.99
Authentication timeout: 120 secs; Authentication retries: 3
Minimum expected Diffie Hellman key size : 1024 bits
IOS Keys in SECSH format(ssh-rsa, base64 encoded):
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCTCpIlSlfPs6UWdJubjBHI8F5yalncOr3ApX1/+seW
VwIlSXc2MjIgv0uzeQZBtdr0FHAOinVyaBbZkjh3yLwbu74YuKjWUlxepxC3ViyKGjAvuPTMWNDxTJzJ
17JOOoP46EAIpzt0683vYe4ixuByD3IU+BY6UfYDpib4Z1AXjAl/PCDkDj14lVBUsaI+aZPkZDV5ZMyH
Gh1qDMjUhnkpRljTfNw0QZ6ks4MFmvfTUtRguKVrI8pkpCv5IupQ73I1XdY0EpXz0Bx5L4Qo/h7O6Wfg
02IWXFgOuAEH0zmpJ/LpKqbP8hE7LEoEWO4DxqlhnWdrDTzBEfL8JzycjRw/
RO-nerd-cafe#

• Verify VTY Line Configuration:

RO-nerd-cafe#show running-config | section line vty
line vty 0 4
 access-class 10 in
 login
 transport input ssh
RO-nerd-cafe#

• Confirm Disabled Services:

RO-nerd-cafe#show running-config | include ip http | ip identd | ip bootp
no ip bootp server
no ip http server
no ip http secure-server
RO-nerd-cafe#

By following these steps, you've configured your Cisco router to allow secure remote management while disabling unnecessary services, aligning with the CIS Cisco IOS 12 Benchmark recommendations. Always remember to tailor configurations to your organization's specific security policies and operational requirements.

Keywords

CIS Cisco IOS 12 Benchmark, Cisco router security, secure remote management, SSH configuration, disable unused services, ACL configuration, VTY lines security, EXEC timeout, login banner, disable HTTP server, disable proxy ARP, disable AUX port, RSA key pair, network security, CIS benchmarks, access control list, Cisco IOS hardening, SSH-only access, router security best practices, secure Cisco configurations, سیسکو