APLawrence.com -  Resources for Unix and Linux Systems, Bloggers and the self-employed

© December 2003 Michael Desrosiers

Hardening your Perimeter

Web Site: https://m3ipinc.com

More Articles

Last year when the first SNMP (Simple Network Management protocol) exploits came out, we cracked an SNMP write community string of a client that we were testing, enabled TFTP (trivial file transfer protocol), sent the config file of the router over to our TFTP server and installed the required management software. At this point, we could very easily have deleted the Access Control Lists (ACLs), used the system to telnet or ssh to internal network systems, or shut the network down entirely.

Compromising a border routing device can lead to total control of a network, either by using privileges learned from the router or by exploiting it and bouncing traffic through another system on its way to it's intended target.

To prevent this from happening, here are several steps that you can take to protect the border of your network. As examples, we will be using a cisco 2500 series router and cisco IOS commands.

Disable services that you do not use

no service udp-small-servers
no service tcp-small-servers
no service finger
no ip httpd server

This disables the finger service (displays user information), the httpd interface (www daemon), discard, echo and chargen (can be used as DDOS generators).

Apply granular rules to your border device

access-list 101 deny tcp any host "router IP" eq 7
access-list 101 deny tcp any host "router IP" eq 9
access-list 101 deny tcp any host "router IP" eq 13
access-list 101 deny tcp any host "router IP" eq 19
access-list 101 deny tcp any host "router IP" eq 23
access-list 101 deny tcp any host "router IP" eq 79

Restricts external access to ports used for re-con attacks.


Restrict telnet access

access-list 103 permit 192.168.1.x
access-list 103 deny any log
line vty 0 4
access-class 103 in
exec-timeout 5 0

With ssh (secure shell, encryption), why telnet (clear text) is still used is beyond the scope of this e-newsletter. But if you must use it, restrict it's access.

Encrypt passwords

enable secret "password"

This is the privileged access path to IOS. Make sure to use the strongest algorithm (md5).

Restrict SNMP access

access-list 104 deny udp any any eq snmp
access-list 104 permit ip any any
interface 1/1
access-group 104 in

If you want to shut it down

no snmp-server

This will stop broadcasting of device information on the network.

Block non-routeable IP address

access-list 102 deny ip any
access-list 102 deny ip any
access-list 102 deny ip any
access-list 102 deny ip any
access-list 102 deny ip any
access-list 102 deny icmp any any redirect
access-list 102 deny ip host any
int 1/1
access-group in 102

There you have it. If it is not needed as a service shut it off. To further see what effect this has on the border device, please feel free to run nmap (https://www.insecure.org/nmap/) and nessus ( https://www.nessus.org/ (link dead, sorry) ) in a before and after assessment.

Also a great reference web site can be found at:

https://www.cisecurity.org/bench_cisco.html (link dead, sorry)

To respond to this or previous newsletters or to inquire about an on-site presentation, please feel free to call us at 508-995-4933 or email us at mdesrosiers@m3ipinc.com.

Have a safe and Merry Christmas!

Until next year.....


Michael Desrosiers
m3ip, Inc.

Got something to add? Send me email.

(OLDER)    <- More Stuff -> (NEWER)    (NEWEST)   

Printer Friendly Version

-> Hardening your Perimeter

Inexpensive and informative Apple related e-books:

Take Control of Upgrading to El Capitan

Photos: A Take Control Crash Course

Take Control of Automating Your Mac

Take Control of Numbers

Take control of Apple TV, Second Edition

More Articles by © Michael Desrosiers

Printer Friendly Version

Have you tried Searching this site?

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more.

Contact us

Printer Friendly Version

The history of the world teaches us that succession is dangerous and that the strong take what they want. It's not likely to be any different with Linux. (Tony Lawrence)

Linux posts

Troubleshooting posts

This post tagged:



Unix/Linux Consultants

Skills Tests

Unix/Linux Book Reviews

My Unix/Linux Troubleshooting Book

This site runs on Linode