APLawrence.com -  Resources for Unix and Linux Systems, Bloggers and the self-employed

Hardening your Perimeter

Web Site: http://m3ipinc.com

More Articles

Last year when the first SNMP (Simple Network Management protocol) exploits came out, we cracked an SNMP write community string of a client that we were testing, enabled TFTP (trivial file transfer protocol), sent the config file of the router over to our TFTP server and installed the required management software. At this point, we could very easily have deleted the Access Control Lists (ACLs), used the system to telnet or ssh to internal network systems, or shut the network down entirely.

Compromising a border routing device can lead to total control of a network, either by using privileges learned from the router or by exploiting it and bouncing traffic through another system on its way to it's intended target.

To prevent this from happening, here are several steps that you can take to protect the border of your network. As examples, we will be using a cisco 2500 series router and cisco IOS commands.

Disable services that you do not use

no service udp-small-servers
no service tcp-small-servers
no service finger
no ip httpd server

This disables the finger service (displays user information), the httpd interface (www daemon), discard, echo and chargen (can be used as DDOS generators).

Apply granular rules to your border device

access-list 101 deny tcp any host "router IP" eq 7
access-list 101 deny tcp any host "router IP" eq 9
access-list 101 deny tcp any host "router IP" eq 13
access-list 101 deny tcp any host "router IP" eq 19
access-list 101 deny tcp any host "router IP" eq 23
access-list 101 deny tcp any host "router IP" eq 79

Restricts external access to ports used for re-con attacks.


Restrict telnet access

access-list 103 permit 192.168.1.x
access-list 103 deny any log
line vty 0 4
access-class 103 in
exec-timeout 5 0

With ssh (secure shell, encryption), why telnet (clear text) is still used is beyond the scope of this e-newsletter. But if you must use it, restrict it's access.

Encrypt passwords

enable secret "password"

This is the privileged access path to IOS. Make sure to use the strongest algorithm (md5).

Restrict SNMP access

access-list 104 deny udp any any eq snmp
access-list 104 permit ip any any
interface 1/1
access-group 104 in

If you want to shut it down

no snmp-server

This will stop broadcasting of device information on the network.

Block non-routeable IP address

access-list 102 deny ip any
access-list 102 deny ip any
access-list 102 deny ip any
access-list 102 deny ip any
access-list 102 deny ip any
access-list 102 deny icmp any any redirect
access-list 102 deny ip host any
int 1/1
access-group in 102

There you have it. If it is not needed as a service shut it off. To further see what effect this has on the border device, please feel free to run nmap (http://www.insecure.org/nmap/) and nessus ( http://www.nessus.org/ (link dead, sorry) ) in a before and after assessment.

Also a great reference web site can be found at:

http://www.cisecurity.org/bench_cisco.html (link dead, sorry)

To respond to this or previous newsletters or to inquire about an on-site presentation, please feel free to call us at 508-995-4933 or email us at mdesrosiers@m3ipinc.com.

Have a safe and Merry Christmas!

Until next year.....


Michael Desrosiers
m3ip, Inc.

Got something to add? Send me email.

Increase ad revenue 50-250% with Ezoic

More Articles by © Michael Desrosiers

Kerio Connect Mailserver

Kerio Samepage

Kerio Control Firewall

Have you tried Searching this site?

Support Rates

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more.

Contact us

Once you eliminate the impossible, whatever remains, no matter how improbable, must be the truth. (Arthur Conan Doyle)

This post tagged: