You can prevent unauthorized users from reconfiguring your device and viewing configuration information. Typically, you want
network administrators to have access to your device while you restrict access to users who dial from outside the network
through an asynchronous port, connect from outside the network through a serial port, or connect through a terminal or workstation
from within the local network.
To prevent unauthorized access into your device, you should configure one or more of these security features:
At a minimum, you should configure passwords and privileges at each device port. These passwords are locally stored on the
device. When users attempt to access the device through a port or line, they must enter the password specified for the port
or line before they can access the device.
For an additional layer of security, you can also configure username and password pairs, which are locally stored on the device.
These pairs are assigned to lines or ports and authenticate each user before that user can access the device. If you have
defined privilege levels, you can also assign a specific privilege level (with associated rights and privileges) to each username
and password pair.
If you want to use username and password pairs, but you want to store them centrally on a server instead of locally, you can
store them in a database on a security server. Multiple networking devices can then use the same database to obtain user authentication
(and, if necessary, authorization) information.
You can also enable the login enhancements feature, which logs both failed and unsuccessful login attempts. Login enhancements
can also be configured to block future login attempts after a set number of unsuccessful attempts are made. For more information,
see the Cisco IOS Login Enhancements documentation.