Disable access to router...only console access needed. 2

[summoner]

Hello:

I am tryhing to disable a cisco 1720's ability to be accessed remotely. We are interested only in accessing the router via the console connection (cisco rollover cable to a serial port). We do not use the auxillary connection and want to disable remote telnet access.

The portion of my "show run" that deals with this sort of thing:

line con 0
 password ######
 login
 transport preferred none
line aux 0
 password ########
 login
 transport preferred none
 transport input all
 stopbits 1
 flowcontrol hardware
line vty 0 4
 password #######
 login
 transport preferred none
 transport input none

I tried disabling the VTY lines and wasn't able to do so. Any ideas? Thanks in advance.

 

[burtsbees]

You could make an access control list or simply remove the password from the vty lines...
router>en
router#conf t
router(config)#line vty 0 4
router(config-line)#no login
router(config-line)#no password xxxxxx
router(config-line)#end
router#wr
That's the easiest way. Let me know if you want to do the acl way...

Burt

 

[summoner]

ahh ok...I was trying to enter a command like:

router(config)#no line vty 0 4

and i was getting errors. I'll try this and let you know.

 

[ADB100]

You could make an access control list or simply remove the password from the vty lines...
router>en
router#conf t
router(config)#line vty 0 4
router(config-line)#no login
router(config-line)#no password xxxxxx
router(config-line)#end
router#wr
That's the easiest way. Let me know if you want to do the acl way...

Burt

Are you sure Burt?.............

That's going to allow access to the vty lines without any authentication (the 'no login' bit).

This works though:

line vty 0 4
 transport input none

HTH

Andy

 

[jneiberger]

No. Removing the password from a VTY line disables remote access to that line. It does not allow someone to enter without authentication. Anyone trying to access that line will get the error message "Password required, but none set." or something to that effect.

 

[ADB100]

No. Removing the password from a VTY line disables remote access to that line. It does not allow someone to enter without authentication. Anyone trying to access that line will get the error message "Password required, but none set." or something to that effect.

Not if you also add the line 'no login', this removes the login from the line and allows you to automatically be presented with the console prompt >

Try it and see..... I use this all the time when setting stuff up, it speeds things up until you are ready to implement your AAA or local authentication etc.

Andy

 

[summoner]

Thanks everyone for all the help.

 

[jneiberger]

Sure, I understand that. I was just pointing out that simply removing the password will not allow unauthenticated access.

 

[burtsbees]

Whoops...really? Hmmm...so if he leaves the login statement there, but simply removes the password, it would work? You wouldn't think so, because originally the login statement is not there, yet you get the error"Password needed, but none set"

Burt

 

[jneiberger]

In that case, the login statement was probably the default. I'm not sure about that. But what you said is true: if "no login" is applied then unauthenticated access is allowed. However, if "login" is configured (or the default), then removing the password is enough to deny terminal access.

 

[burtsbees]

apparently...hang on...I'll try...
Man---consoling to one of my 2924's (the one I use) just locked it up!!! Stupid PuTTy...lemme try HyperCrash...I mean, Hyperterminal...
Well I'll be...
Cat2924>en
Cat2924#conf t
Cat2924(config)#line vty 0 4
Cat2924(config-line)#no login
This does let me telnet without having to use a password, but the enable password prevents me from getting to the priveleged exec prompt w/o a password...
Cat2924(config-line)#no pass
This gives me the error "Password set, but none required"
I actually now remember another post here in Tek-Tips about this...thanks Andy...here's another star bro.

Burt

 

[burtsbees]

Interesting...turns out the switch locked every time with the console cable plugged in...anyone else ever have this problem?
I would power cycle the switch, and it came up okay once, and I tried PuTTy and it worked fine. I closed PuTTy, and it locked up about a minute later...I power cycled the switch three other times, no dice---still all the lights lit and once only the interface lights that have something plugged in lit, but steady---unresponsive. It occurred to me to unplug the console cable and power cycle it again---it's been fine now...weird.

Burt

 

[ADB100]

If you set the 'transport input none' then you can't even telnet/SSH to the switch; there is no response. Which in my book is much more secure - if it responds then there is potential for attack...

HTH

Andy