Just out of general interest guys,

[ChrisAC]

Just out of general interest guys, if you have a lot of routers to manage, say 300 plus, what kind of password policy do you implement? How often do you rotate passwords and how do you control access to those routers so that not anybody can have a crack at them?

This issue has come us recently at work and I'd like to know how other people handle it. Any input would be most welcome.

Chris.
**********************
Chris Andrew, CCNA, CCSA
chris@iproute.co.uk
**********************

 

[hexn]

We have a password daemon that runs on a linux box that updates the passwords every 1 month, and keeps a database of all past passwords. I believe it does it via SNMP and then opens a telnet session and tests the passwords to make sure they work.

Then it sends the new passwords to the the head engineers pagers.

Of course this linux box is locked down very tight. Like it only enables the ethernet once a month during the password change and then shuts it back down.

The root password to the linux box is a 12 digit alphanumeric password which is changed each time a head engineer leaves the company.

Or course, in our routing environment, you dont make changes all that often. Most of the time you just want to get some info from the router (like show commands) and this is easily done via snmp without having to actually know the router passwords. This is very good cause then it protects you from some dumb tech accidentally entering a wrong command.

When a change does need to be made to a router, it is done over a web interface using PHP. The commands are entered in, then it is sent to the supervisor to confirm, then the linux box opens a telnet session, runs the commands, and prints the results to the webpage. Again, this is very efficient because no passwords need be remembered or shown.

Security a little tight? You betcha!

 

[ChrisAC]

Inikis,

That is a very tight system you have there! I'd like to have that kind of automated system but at the moment everything is done manually. Is your password daemon off the shelf or developed "in house"? I'm guessing in house. Maybe it's time that we started looking at something like that as the number of customer routers is growing rapidly.

Thanks for the input.

Chris.
**********************
Chris Andrew, CCNA, CCSA
chris@iproute.co.uk
**********************

 

[mojo2002]

Could this be run from a windows based machine?

thanks,
steven

 

[hexn]

Yes, it is absolutely compatible with windows. Runs on PHP and MySQL. I built most all of it myself. It boils down to a little PHP/MySQL programming, and a few cron jobs.