Users=Robots & Monkeys

Cisco Router Security the Easy Way

tcstool — Wed, 29 Oct 2008 23:48:30 +0000

Here’s a repost of my contribution the pauldotcommunity blog about some fundemental things a new Cisco admin or someone non-fluent in the IOS can do to lock down their devices…Enjoy!

After hearing about Fyodor’s scanning the Internet project, I started thinking about what he found…My reaction was much the same as Paul’s…Telnet??? Really? Then I started thinking about the work I did back in the day when I was dangerously unqualified to do my job and had no idea what I was doing, and how many Cisco routers I left telnet open on the WAN interface simply for convenience. Over the years, I’ve found most consulting companies do this without telling the customer, and if you’re using an outside vendor to manage your Cisco gear, I would check! Having had to do quite a bit of router securing lately, I thought this would be a good time to cover some really simple ways to secure your routers for the non-Cisco guys out there, other than the obvious firmware updates and such. All of these methods should work on the more recent versions of the IOS. This post will cover some very basic router security methods. There is a real science to securing Cisco IOS devices, and it’s certainly possible to make your router security scheme very complex, but hopefully this gives you a good starting point if you’re not already doing these things.

Adding Local Users
One of the simplest ways to lock down your Cisco gear is by adding a local authentication database to your router. This is something that Cisco simply doesn’t stress enough. Even if you go through their CCNA training, they teach you there’s a password to log in (telnet, console, etc.) and the enable password, both of which are subject to brute forcing…But think about how much more secure your gear is if an attacker has to guess both a username and a password. It would certainly render brute forcing impossible. Here’s a simple example:

Larry(config)#aaa new-model
Larry(config)#username Larry privilege 15 password beer
Larry(config)#aaa authentication login default local

Looking at what we did, we first enabled authentication, authorization, and accounting services on our router. We then created a user named Larry with a password of beer that has a privilege level of 15. We then set the default login method for all management on the router to use the local database (i.e. usernames and passwords we create on the router itself). Now when telnetting in, connecting via a console cable, SSH, whatever, the user must present two sets of credentials. Of course if you make the username admin, cisco, etc. then this isn’t a whole lot better, but using an uncommon username and password helps. You can do a lot more with creating limited privilege user accounts, custom views, authenticating and authorizing command execution via TACACS+ and RADIUS, and password policies but that’s beyond the scope of this post.

Enabling SSH
Solving the problem of telnet’s plain text transmission is actually quite simple. Before starting make sure you are on IOS version 12.1(19)E because that’s the first revision that supports SSHv2. Enabling SSH on a router requires two lines:

Larry(config)#ip domain-name pauldotcom.com
Larry(config)#crypto key generate rsa modulus 1024 general-keys
The name for the keys will be: Larry.pauldotcom.com
% The key modulus size is 1024 bits% Generating 1024 bit RSA keys, keys will be non-exportable…[OK]
Larry(config)#*Mar 1 00:19:52.391: %SSH-5-ENABLED: SSH 1.99 has been enabled

First we have to specify a domain name using the ip domain-name command so our router has an FQDN, then generate our keys. You can specify whatever key size you want (I used 1024 in the above example). After that SSH is automatically turned on for you. To get rid of telnet management completely, we have to do one more thing:

Larry(config)#line vty 0 4
Larry(config-line)#transport input ssh

Router Auto Secure
Cisco routers have lots of services running on them, most of them totally useless. Cisco has now provided an easy way to disable these services and enhance the security of your router in a number of ways with one command. Also if you use Cisco Secure Device Manager (SDM) for router management, it features a security audit tool and a one click lockdown tool for disabling these services. I’m still a console guy though, so I like this method. Look at how much useless stuff is turned off just after the first step, and how much you get by running one simple command:

Larry#auto secure
Is this router connected to internet? [no]:
Securing Management plane services…
Disabling service finger
Disabling service pad
Disabling udp & tcp small servers
Enabling service password encryption
Enabling service tcp-keepalives-in
Enabling service tcp-keepalives-out
Disabling the cdp protocol
Disabling the bootp server
Disabling the http server
Disabling the finger service
Disabling source routing
Disabling gratuitous arp

Finger? Come on. There wizard does a lot more, allowing you to set your login banner (and providing a pretty scary default one), configure an enable secret, set up blocking periods when login attacks are detected, and enabling the CBAC firewall.

So there you have it. I hope this was interesting, and be sure to find me lurking around #pauldotcom if you have any questions or comments.

Windows Server 2008…The other shoe finally drops

tcstool — Sat, 14 Jun 2008 15:58:01 +0000

Well I’m back again after another lengthy, baby-related hiatus. Hopefully things will calm down soon so the blog-writing will pick up!

Recently I had the opportunity to attend a Microsoft TechNet event (themed “Heroes Happen Here”…catchy!). Being in the Infrastructure IT Pro track, the focus of our presentation was on Windows Server 2008 and all the great new enhancements Microsoft has brought to the table with this release. Now, given some of the predicaments Microsoft’s buggy software has put me in in the past, I’m mainly a Linux guy. But this release looked good…REALLY good. The number of enhancements to Terminal Services (Goodbye Citrix), the settings you can push out by group policy, the logging capabilities, and the cherry on top Hyper-V make this look like a really strong release!

If you haven’t seen any of the new features Server 2008 brings, here are some of my favorites:

Server 2008 Core-Now you can install the server with no GUI, no .NET, no IIS…Just a command prompt out of the box. From there you can use a very intuitive command line interface or the graphical remote management tools from your desktop to administer the server. The performance enhancements from chunking the GUI alone are HUGE!
Remote Administration-Microsoft has followed Linux/BSD and put a protocol in place for a remote command shell from a server. This one has me a little nervous because it seems like something that could be compromised and used maliciously, but if Microsoft can get the security on it right it will be a big improvement.
Terminal Services-Admittedly, Microsoft has stolen a lot from Citrix here. Terminal server now includes seamless application windows, so the user doesn’t have the effect of a Terminal Server (the application starts from an icon on their desktop and even though it runs on the terminal server appears to the user as though it’s running locally). Also, they’ve incorporated a web gateway for TS users to access their applications from.

So seeing all this (not to mention the fact they sent us home with a big binder of software including server 2008, SQL 2008 and Windows Vista Ultimate), I decided to drink the Kool-Aid and upgrade my home server to play around with some of the new features. I figured it would be a good test and fairly safe as I mainly use it to host my personal email on Exchange 2003 and share files with friends over FTP. As you might guess, this is where the shoe begins to drop…

The upgrade itself was fairly easy. I had to do the usual adprep /forestprep and adprep /domainprep to load the new schema extensions for Active Directory, and remove FrontPage Extensions from IIS. No big surprises there and the installer was actually quite helpful in telling me what was wrong and how to remediate the problem each step of the way. I fed it my product key and off it went. Truthfully I didn’t even watch the upgrade process, just let it run on its own and came back the next morning to find my nice shiny install of Server 2008 waiting for me to log in.

So I log in, get the desktop, and figure that everything is good to go. After all, I haven’t gotten any cryptic Microsoft error dialogs yet right? So I took a minute before work to check a few things. The Active Directory was there and in place, I could connect via FTP, everything seemed all right. I did notice the Exchange System Manager MMC wouldn’t load, but figured it was a common issue and something that would be easy to correct. I went off to work feeling good about the project.

I came home from work later that day to sit down and check my email. My Outlook client refused to connect to the Exchange server. Hmmm…I remote in to discover that all of the Exchange services were stopped. no big deal right? Exchange is finicky and those services trip up sometimes. I try to fire up the information store service and it bombs immediately failing to start. The other services were all the same. So I start poking around on the Internet and find people saying Exchange 2k3 won’t run on Server 2008. Not a big deal…I figured I have an MSDN account and a 64 bit processor in my server, I’ll just rebuild using Exchange 2007! Wrong again. Exchange 2007 won’t upgrade on Server 2008 either…A detail they conveniently forgot to mention in their presentation hyping how great this OS is.

So now my server is happily running FreeBSD, Postfix, and Spamassassin…And life is good again.

Why Cisco owes us

tcstool — Thu, 01 May 2008 00:40:47 +0000

So I’m back for round 2, much later than I thought I would be. Let’s just say that having a 4 week old infant in the house and trying to start the Internet’s most rockin’ infosec and “in the trenches” IT blog isn’t easy.

So today I want to gripe a little about Cisco, the company sysmins everywhere love to hate. I guess it was easy for them during the Internet boom; They could build networking hardware that was difficult to configure and manage because they were the only game in town. I’m sure this was great when the Internet mostly consisted of Gopher connected to university libraries and about a dozen dinosaur pictures on the web. People didn’t mind waiting 3 days for their connections while the engineers got approval to pay Cisco’s huge phone support fees to figure out why their interface wouldn’t come up or trying to sort whether the problem was with the telco, the hardware, the engineer, the janitor, or Monica Lewinsky.

Fast forward to today. I went to install an 1801 router bridged to a DSL connection. Pretty easy day 1 stuff right? Not anymore. I start configuring the device, logging in with the default username and password of cisco and cisco, and figure “hey, I’ll change it later after I get the connection up”. I walk away to take a lunch break after doing about 20 minutes of good solid programming, returning to find that you can use the cisco ID ONCE. If your session times out and you didnt’ change it, time to go back to defaults. Thank goodness I hadn’t written my changes to flash yet, or I would have gone through the long, arduous ROMMON defaulting process, costing my customer more time and money. a quick reboot to the router and I was ready to start over.

This time I changed the user ID and password having learned from my previous mistake. I assigned my public static IP and my default route to the appropriate FastEthernet interface and was ready to start configuring my internal connectivity. I try to assign an IP to one of the 8 other interfaces on the unit, only to be greeted by an error stating this was a Layer 2 port and couldn’t be assigned an IP. Of course! Why would I want a router that could be attached to TWO networks at once? Isn’t the basic definition of a router to route traffic between TWO or more networks? A quick trip to Experts Exchange revealed you have to take a port and place it in a separate VLAN, assign that VLAN an IP, and change the access mode of the port. I’m sure this is all in the name of security, to prevent traffic from the outside hitting your other internal hosts attached to the router, but to me this seems like trying to cram features that should be performed on the firewall into the router. Cisco makes firewalls…Good ones too…why would they want to discourage people from buying them???

So after that snafu, I finished my setup and tested my configuration. Worked like a charm on the first try. I decided to ahead and enable telnet access so I could pop back into the router from the internal network later and finish a few things (Yes I know I should be using SSH but I need a quick and dirty solution that I can hit from any workstation). I did the usual line vty 0 4 config and added a login statement. Swing and a miss! Seems now Cisco adds an access list by default preventing telnet traffic from hitting the router.

The point of all this…Cisco owes me one for putting up with this crap. Yes I applaud them for trying to make their products more secure, but security is an all or nothing game. If they’re so worried about security they are making things take twice as long to set up, why not use a more regular patching cycle to plug gaping security holes faster? I encourage everyone to check out this article. Notice the HUGE gap between patch releases. Can you imagine the chaos this is going to cause when admins try to apply 6 months worth of fixes to their hardware at once? It’s more incentive to NOT do it (Are you listening Oracle???).

In addition Cisco owes me $375 for failing the CCNA 3 times. In what real world scenario could you possibly be expected to program routers at 4 sites with automatic routing updates in under 7 minutes? Despite the fact that I have designed complex voice routing, connectivity, and failover solutions using cisco hardware, I can’t call myself a qualified technician because I can’t meet the purely ridiculuous requirements of their exam. If it was just me I could buy that I’m just a crappy test taker (despite having passed all my MCSE exams, Security+, Linux+, and CEH tests on the first try), but EVERYONE has problems with this test, including guys who are a lot smarter than me.

So in conclusion, these are my arguments that Cisco owes the IT community as a whole better products. The next time a vendor comes peddling cisco, take a look at some of the other options on the market before taking the plunge.

We’re all cowards

tcstool — Thu, 17 Apr 2008 00:13:12 +0000

If you’re reading this, my first blog post EVER (and as such my first journey into the terrifying world of being a Web 2.0 whore), then aren’t you lucky…And I’m sure you’re also wondering why I’m doing this, and where I came up with such a ridiculous name for a blog. Well you’re about to find out…

To answer the first question, I was inspired by a friend of mine who started his own blog (shameless plug for him: www.digitalbush.com). He seems to use it as a creative outlet for whining about his job and throwing ideas on writing code out for the world’s scrutiny, and I thought it was a pretty sweet idea. While I’m not a coder by trade, I am a voice and data engineer for an IT consulting company, and I think we share many of the same frustrations.

As for the name, I adapted it from a speech a client gave me once. On one of my first trips to their office, I had set up a PC and user profile in a slightly different manner than the others machines were. Quite proud of myself, I expected to get some praise for making things easier for the users, streamling their processes, and so forth. Instead, I got a 30 minute lecture on how the users there are (you guessed it) robots and monkeys, who unless they see the same output every time at every workstation have no idea what to do. The speech struck me as quite humorous and a reflection on the IT industry as a whole. As IT professionals, we fear change, but we know it’s unavoidable. How many of us have appliances on our network with firmware 2-3 years out of date, just because, despite fixing several security vulnerabilities and bugs in the product, we’re afraid the upgrade is going to mess up that one feature the CEO uses? Or even worse, we leave servers unpatched and vulnerable because we’re afraid of causing downtime? I think it’s a sad statement when Microsoft releases Windows Server 2008 and publicly admits they don’t expect anyone to migrate to it anytime soon, despite the great new feature sets it brings to the table. All this is a long, roundabout way of imploring my fellow IT professionals to control the technology, not let the technology control you. In the end, you’ll be glad you did when your networks are stable, secure, and feature rich.

Future posts will contain more specific ranting and musing about Microsoft, Cisco, Linux, Dell, wireless, and pretty much anything else I can think of. Stay tuned.