Configuring Security with Passwords Privileges and Logins

When you start a session on a router, you generally begin in user EXEC mode , which is one of two access levels of the EXEC mode. For security purposes, only a limited subset of EXEC commands are available in user EXEC mode. This level of access is reserved for tasks that do not change the configuration of the router, such as determining the router status.

If your device is configured to require users to log-in the log-in process will require a username and a password. You may try three times to enter a password before the connection attempt is refused.

User EXEC mode is set by default to privilege level 1. Privileged EXEC mode is set by default to privilege level 15. For more information see the Privileged EXEC Mode. When you are logged into a networking device in user EXEC mode your session is running at privilege level 1. By default the EXEC commands at privilege level 1 are a subset of those available at privilege level 15. When you are logged into a networking device in privileged EXEC mode your session is running at privilege level 15. You can move commands to any privilege level between 1 and 15 using the privilege command. See the Cisco IOS XE Privilege Levels for more information on privilege levels and the privilege command.

In general, the user EXEC commands allow you to connect to remote devices, change terminal line settings on a temporary basis, perform basic tests, and list system information.

To list the available user EXEC commands, use the following command:

Router(config)# ?

The user EXEC mode prompt consists of the host name of the device followed by an angle bracket (>), as shown in the following example:

Router>

The default host name is generally Router, unless it has been changed during initial configuration using the setup EXEC command. You also change the host name using the hostname global configurationcommand.

Note

Examples in Cisco IOS XE documentation assume the use of the default name of "Router." Different devices (for example, access servers) may use a different default name. If the routing device (router, access server, or switch) has been named with the hostname command, that name will appear as the prompt instead of the default name.

To list the commands available in user EXEC mode, enter a question mark (?) as shown in the following example:

Router> ?
 
Exec commands:
 <1-99>           Session number to resume
 connect          Open a terminal connection
 disconnect       Disconnect an existing telnet session
 enable           Turn on privileged commands
 exit             Exit from Exec mode
 help             Description of the interactive help system
 lat              Open a lat connection
 lock             Lock the terminal
 login            Log in as a particular user
 logout           Exit from Exec mode and log out
 menu             Start a menu-based user interface
 mbranch          Trace multicast route for branch of tree
 mrbranch         Trace reverse multicast route to branch of tree
 mtrace           Trace multicast route to group
 name-connection  Name an existing telnet connection
 pad              Open a X.29 PAD connection
 ping             Send echo messages
 resume           Resume an active telnet connection
 show             Show running system information
 systat           Display information about terminal lines
 telnet           Open a telnet connection
 terminal         Set terminal line parameters
 tn3270           Open a tn3270 connection
 trace            Trace route to destination
 where            List active telnet connections
 x3               Set X.3 parameters on PAD

The list of commands will vary depending on the software feature set and router platform you are using.

Note	You can enter commands in uppercase, lowercase, or mixed case. Only passwords are case sensitive. However, Cisco IOS XE documentation convention is to always present commands in lowercase.

In order to have access to all commands, you must enter privileged EXEC mode , which is the second level of access for the EXEC mode. Normally, you must enter a password to enter privileged EXEC mode. In privileged EXEC mode, you can enter any EXEC command, because privileged EXEC mode is a superset of the user EXEC mode commands.

Because many privileged EXEC mode commands set operating parameters, privileged EXEC level access should be password protected to prevent unauthorized use. The privileged EXEC command set includes those commands contained in user EXEC mode. Privileged EXEC mode also provides access to configuration modes through the configurecommand, and includes advanced testing commands, such as debug.

Privileged EXEC mode is set by default to privilege level 15. User EXEC mode is set by default to privilege level 1. For more information see the User EXEC Mode. When you are logged into a networking device in privileged EXEC mode your session is running at privilege level 15. When you are logged into a networking device in user EXEC mode your session is running at privilege level 1. By default the EXEC commands at privilege level 15 are a superset of those available at privilege level 1. You can move commands to any privilege level between 1 and 15 using the privilege command. See the Cisco IOS XE Privilege Levels for more information on privilege levels and the privilege command.

The privileged EXEC mode prompt consists of the host name of the device followed by a pound sign(#), as shown in the following example:

Router#

To access privileged EXEC mode, use the following command:

Router> enable

Password

Router# exit

Router>

Note	Privileged EXEC mode is sometimes referred to as "enable mode," because the enable command is used to enter the mode.

If a password has been configured on the system, you will be prompted to enter it before being allowed access to privileged EXEC mode. The password is not displayed on the screen and is case sensitive. If an enable password has not been set, privileged EXEC mode can be accessed only by a local CLI session (terminal connected to the console port).

If you attempt to access privileged EXEC mode on a router over a remote connection, such as a telnet connection, and you have not configured a password for privileged EXEC mode you will see the % No password set error message. For more information on remote connections see the Remote CLI Sessions. The system administrator uses the enable secret or enable passwordglobal configuration commands to set the password that restricts access to privileged EXEC mode. For information on configuring a password for privileged EXEC mode, see the Protecting Access to Privileged EXEC Mode.

To return to user EXEC mode, use the following command:

Router# disable

The following example shows the process of accessing privileged EXEC mode:

Router> enable
Password:<letmein>
Router# 

Note that the password will not be displayed as you type, but is shown here for illustrational purposes.To list the commands available in privileged EXEC mode, issue the ? command at the prompt. From privileged EXEC mode you can access global configuration mode, which is described in the following section.

Note

Because the privileged EXEC command set contains all of the commands available in user EXEC mode, some commands can be entered in either mode. In Cisco IOS XE documentation, commands that can be entered in either user EXEC mode or privileged EXEC mode are referred to as EXEC mode commands. If user or privileged is not specified in the documentation, assume that you can enter the referenced commands in either mode.

The term "global" is used to indicate characteristics or features that affect the system as a whole. Global configuration mode is used to configure your system globally, or to enter specific configuration modes to configure specific elements such as interfaces or protocols. Use the configure terminalprivileged EXEC command to enter global configuration mode.

To access global configuration mode, use the following command in privileged EXEC mode:

Router#
 configure terminal

The following example shows the process of entering global configuration mode from privileged EXEC mode:

Router# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#

Note that the system prompt changes to indicate that you are now in global configuration mode. The prompt for global configuration mode consists of the host-name of the device followed by (config) and the pound sign ( # ). To list the commands available in privileged EXEC mode, issue the ? command at the prompt.

Commands entered in global configuration mode update the running configuration file as soon as they are entered. In other words, changes to the configuration take effect each time you press the Enter or Return key at the end of a valid command. However, these changes are not saved into the startup configuration file until you issue the copy running-config startup-config EXEC mode command. This behavior is explained in more detail later in this document.

As shown in the example above, the system dialogue prompts you to end your configuration session (exit configuration mode) by pressing the Control (Ctrl) and "z" keys simultaneously; when you press these keys, ^Z is printed to the screen. You can actually end your configuration session by entering the Ctrl-Z key combination, using the end command, using the Ctrl-C key combination. The end command is the recommended way to indicate to the system that you are done with the current configuration session.

Caution

If you use Ctrl-Z at the end of a command line in which a valid command has been typed, that command will be added to the running configuration file. In other words, using Ctrl-Z is equivalent to hitting the Enter (Carriage Return) key before exiting. For this reason, it is safer to end your configuration session using the end command. Alternatively, you can use the Ctrl-C key combination to end your configuration session without sending a Carriage Return signal.

You can also use the exit command to return from global configuration mode to EXEC mode, but this only works in global configuration mode. Pressing Ctrl-Z or entering the end command will always take you back to EXEC mode regardless of which configuration mode or configuration submode you are in.

To exit global configuration command mode and return to privileged EXEC mode, use one of the following commands:

Router(config)# end

Router(config)# ^Z

Router(config)# exit

From global configuration mode, you can enter a number of protocol-specific, platform-specific, and feature-specific configuration modes.

Interface configuration mode, described in the following section, is an example of a configuration mode you can enter from global configuration mode.

One example of a specific configuration mode you enter from global configuration mode is interface configuration mode.

Many features are enabled on a per-interface basis. Interface configuration commands modify the operation of an interface such as an Ethernet, FDDI, or serial port. Interface configuration commands always follow an interface global configuration command, which defines the interface type.

For details on interface configuration commands that affect general interface parameters, such as bandwidth or clock rate, refer to the Release 12.2 Cisco IOS Interface Configuration Guide . For protocol-specific commands, refer to the appropriate Cisco IOS XE software command reference.

To access and list the interface configuration commands, use the following command:

Router(config)# interface type number

In the following example, the user enters interface configuration mode for serial interface 0. The new prompt, hostname (config-if)#, indicates interface configuration mode.

Router(config)# interface serial 0
Router(config-if)#

To exit interface configuration mode and return to global configuration mode, enter the exit command.

Configuration submodes are configuration modes entered from other configuration modes (besides global configuration mode). Configuration submodes are for the configuration of specific elements within the configuration mode. One example of a configuration submode is subinterface configuration mode, described in the following section.

From interface configuration mode, you can enter subinterface configuration mode. Subinterface configuration mode is a submode of interface configuration mode. In subinterface configuration mode you can configure multiple virtual interfaces (called subinterfaces) on a single physical interface. Subinterfaces appear to be distinct physical interfaces to the various protocols.

For detailed information on how to configure subinterfaces, refer to the appropriate documentation module for a specific protocol in the Cisco IOS XE software documentation set.

To access subinterface configuration mode, use the following command in interface configuration mode:

Router(config-if)# interface type number

In the following example, a subinterface is configured for serial line 2, which is configured for Frame Relay encapsulation. The subinterface is identified as "2.1" to indicate that it is subinterface 1 of serial interface 2. The new prompt hostname (config-subif)# indicates subinterface configuration mode. The subinterface can be configured to support one or more Frame Relay PVCs.

Router(config)# interface serial 2
Router(config-if)# encapsulation frame-relay
Router(config-if)# interface serial 2.1
Router(config-subif)#

To exit subinterface configuration mode and return to interface configuration mode, use the exit command. To end your configuration session and return to privileged EXEC mode, press Ctrl-Z or enter the end command.

Local CLI sessions require direct access to the the console port of the networking device. Local CLI sessions start in user EXEC mode. See the Cisco IOS XE CLI Modes for more information on the different modes that are supported on your networking device. All of the tasks required to configure and manage a networking device can be done using a local CLI session. The most common method for establishing a local CLI session is to connect the serial port on a PC to the console port of the networking device and then to launch a terminal emulation application on the PC. The type of cable and connectors required and the settings for the terminal emulation application on the PC are dependant on the type of networking device that you are configuring. See to the documentation for your networking device for more information on setting it up for a local CLI session.

Remote CLI sessions are created between a host such as a PC and a networking device such as a router over a network using a remote terminal access application such as Telnet and Secure Shell (SSH). Local CLI sessions start in user EXEC mode. See the Cisco IOS XE CLI Modes for more information on the different modes that are supported on your networking device. Most of the tasks required to configure and manage a networking device can be done using a remote CLI session. The exceptions are tasks that interact directly with the console port (such as recovering from a corrupted operating system (OS) by uploading a new OS image over the console port) and interacting with the networking device when it is in ROM Monitor Mode.

This document explains how to configure security for remote Telnet sessions. Telnet is the most common method for accessing a remote CLI session on a networking device.

Note

SSH is a more secure alternative to Telnet. SSH provides encryption for the session traffic between your local management device such as a PC and the networking device that you are managing. Encrypting the session traffic with SSH prevents hackers that might intercept the traffic from being able to decode it. See Secure Shell Version 2 Support feature module for more information on using SSH.

Cisco networking devices use the word lines to refer to the software components that manage local and remote CLI sessions. You use the line console 0 global configuration command to enter line configuration mode to configure options, such as a password, for the console port.

Router# configure terminal
Router(config)# line console 0
Router(config-line)# password
 password-string

Remote CLI sessions use lines that are referred to virtual teletypewriter (VTY) lines. You use the line vty line-number[ending-line-number]global configuration command to enter line configuration mode to configure options, such as a password, for remote CLI sessions.

Router# configure terminal
Router(config)# line vty 
0 4
Router(config-line)# password
 password-string

The first step in creating a secure environment for your networking device is protecting access to user EXEC mode by configuring passwords for local and remote CLI sessions.

You protect access to user EXEC mode for local CLI sessions by configuring a password on the console port. See the Configuring and Verifying a Password for Local CLI Sessions.

You protect access to user EXEC mode for remote CLI sessions by configuring a password on the virtual terminal lines (VTYs). See the Configuring and Verifying a Password for Remote CLI Sessions for instructions on how to configure passwords for remote CLI sessions.

The second step in creating a secure environment for your networking device is protecting access to privileged EXEC mode with a password. The method for protecting access to privileged EXEC mode is the same for local and remote CLI sessions.

You protect access to privileged EXEC mode by configuring a password for it. This is sometimes referred to as the enable password because the command to enter privileged EXEC mode is enable.

                
                  enable
                
              

Router> enable

Password 

Router#

Before You Begin

If you have not previously configured a password for remote CLI sessions, you must perform this task over a local CLI session using a terminal or a PC running a terminal emulation application, attached to the console port.

Your terminal, or terminal emulation application, must be configured with the settings that are used by the console port on the networking device. The console ports on most Cisco networking devices require the following settings: 9600 baud, 8 data bits, 1 stop bit, no parity, and flow control is set to "none." See the documentation for your networking device if these settings do not work for your terminal.

To perform the verification step (Step 6) for this task, your networking device must have an interface that is in an operational state. The interface must have a valid IP address.

Note	If you have not previously configured a password for remote CLI sessions, you must perform this task over a local CLI session using a terminal attached to the console port. >

1.    enable

2.    configure terminal

3.    line vty line-number [ending-line-number]

4.    password password

5.    end

6.    telnet ip-address

7.    exit

• Troubleshooting Tips
• What to Do Next

1.    enable

2.    configure terminal

3.    line console 0

4.    password password

5.    end

6.    exit

7.    Press the Enter key.

• Troubleshooting Tips
• What to Do Next

Cisco no longer recommends that you use the enable password command to configure a password for privileged EXEC mode. The password that you enter with the enable passwordcommand is stored as plain text in the configuration file of the networking device. You can encrypt the password for the enable passwordcommand in the configuration file of the networking device using the service password-encryption command. However the encryption level used by the service password-encryption command can be decrypted using tools available on the Internet.

Instead of using the enable passwordcommand, Cisco recommends using the enable secret commandbecause it encrypts the password that you configure with it with strong encryption . For more information on password encryption issues see the Cisco IOS XE Password Encryption Levels. For information on configuring the enable secretcommand see the Configuring and Verifying the Enable Secret Password.

Note

The networking device must not have a password configured by the enable secret command in order to perform this task successfully. If you have already configured a password for privileged EXEC mode using the enable secretcommand, the password configured takes precedences over the password that you configure in this task using the enable password command. You cannot use the same password for the enable secretcommand and the enable password command. >

1.    enable

2.    configure terminal

3.    enable password password

4.    end

5.    exit

6.    enable

• Troubleshooting Tips
• What to Do Next

1.    enable

2.    configure terminal

3.    service password-encryption

4.    end

Cisco recommends that you use the enable secret command, instead of the enable password command to configure a password for privileged EXEC mode. The password created by the enable secret command is encrypted with the more secure MD5 algorithm.

Note	You cannot use the same password for the enable secretcommand and the enable password command. >

1.    enable

2.    configure terminal

3.    enable secret password

4.    end

5.    exit

6.    enable

• Troubleshooting Tips
• What to Do Next

The tasks in this section describe how to configure your networking device to permit the use of a subset of privileged EXEC mode commands by users who should not have access to all of of the commands available in privileged EXEC mode.

These tasks are beneficial for companies that have multiple levels of network support staff and the company wants the staff at each level to have access to a different subset of the privileged EXEC mode commands.

In this task the users who should not have access to all of of the commands available in privileged EXEC mode are referred to as the first-line technical support staff.

This section contains the following procedures:

• Configuring the Networking Device for the First-Line Technical Support Staff
• Verifying the Configuration for the First-Line Technical Support Staff
• Configuring a Device to Require a Username for the First-Line Technical Support Staff

There are three methods that can be used to recover from a lost or misconfigured password for local CLI sessions over console port. The method that you will use depends on the current configuration of your networking device.

• Networking Device Is Configured to Allow Remote CLI Sessions
• Networking Device Is Not Configured to Allow Remote CLI Sessions

There are three methods that can be used to recover from a lost, or misconfigured remote CLI session password. The method that you will use depends on the current configuration of your networking device.

• Networking Device Is Configured to Allow Local CLI Sessions
• Networking Device Is Not Configured to Allow Local CLI Sessions

There are two methods that can be used to recover from a lost, or misconfigured Privileged EXEC Mode password. The method that you will use depends on the current configuration of your networking device.

• A Misconfigured Privileged EXEC Mode Password Has Not Been Saved