© December 2003 Michael Desrosiers

Hardening your Perimeter

Web Site: https://m3ipinc.com

More Articles

Last year when the first SNMP (Simple Network Management protocol) exploits came out, we cracked an SNMP write community string of a client that we were testing, enabled TFTP (trivial file transfer protocol), sent the config file of the router over to our TFTP server and installed the required management software. At this point, we could very easily have deleted the Access Control Lists (ACLs), used the system to telnet or ssh to internal network systems, or shut the network down entirely.

Compromising a border routing device can lead to total control of a network, either by using privileges learned from the router or by exploiting it and bouncing traffic through another system on its way to it's intended target.

To prevent this from happening, here are several steps that you can take to protect the border of your network. As examples, we will be using a cisco 2500 series router and cisco IOS commands.

Disable services that you do not use

no service udp-small-servers
no service tcp-small-servers
no service finger
no ip httpd server
 

This disables the finger service (displays user information), the httpd interface (www daemon), discard, echo and chargen (can be used as DDOS generators).

Apply granular rules to your border device

access-list 101 deny tcp any host "router IP" eq 7
access-list 101 deny tcp any host "router IP" eq 9
access-list 101 deny tcp any host "router IP" eq 13
access-list 101 deny tcp any host "router IP" eq 19
access-list 101 deny tcp any host "router IP" eq 23
access-list 101 deny tcp any host "router IP" eq 79
 

Restricts external access to ports used for re-con attacks.

7=echo
9=discard
13=daytime
19=chargen
23=telnet
79=finger
 

Restrict telnet access

access-list 103 permit 192.168.1.x
access-list 103 deny any log
line vty 0 4
access-class 103 in
exec-timeout 5 0
 

With ssh (secure shell, encryption), why telnet (clear text) is still used is beyond the scope of this e-newsletter. But if you must use it, restrict it's access.

Encrypt passwords

enable secret "password"
 

This is the privileged access path to IOS. Make sure to use the strongest algorithm (md5).

Restrict SNMP access

access-list 104 deny udp any any eq snmp
access-list 104 permit ip any any
interface 1/1
access-group 104 in
 

If you want to shut it down

no snmp-server
 

This will stop broadcasting of device information on the network.

Block non-routeable IP address

access-list 102 deny ip 127.0.0.0 0.255.255.255 any
access-list 102 deny ip 10.0.0.0 0.255.255.255 any
access-list 102 deny ip 172.16.0.0 0.15.255.255 any
access-list 102 deny ip 192.168.0.0 0.0.255.255 any
access-list 102 deny ip 224.0.0.0 7.255.255.255 any
access-list 102 deny icmp any any redirect
access-list 102 deny ip host 0.0.0.0 any
int 1/1
access-group in 102
 

There you have it. If it is not needed as a service shut it off. To further see what effect this has on the border device, please feel free to run nmap (https://www.insecure.org/nmap/) and nessus ( https://www.nessus.org/ (link dead, sorry) ) in a before and after assessment.

Also a great reference web site can be found at:

https://www.cisecurity.org/bench_cisco.html (link dead, sorry)

To respond to this or previous newsletters or to inquire about an on-site presentation, please feel free to call us at 508-995-4933 or email us at mdesrosiers@m3ipinc.com.

Have a safe and Merry Christmas!

Until next year.....

Regards,

Michael Desrosiers
Founder
m3ip, Inc.
1-508-995-4933
mdesrosiers@m3ipinc.com
https://www.m3ipinc.com

Got something to add? Send me email.

---

Have you tried Searching this site?

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more.

Contact us