Best Practices

! Management Interface
R1#configure terminal
R1(config)#control-plane host
R1(config-cp-host)#management-interface gig 1/0 allow ssh https snmp
R1(config-cp-host)#exit

R1#show control-plane host features

! Timeouts on TVY sessions
R1(config)#line vty 0 15
R1(config-line)#exec-timeout 10       (Min)
R1(config-line)#exit

! Disable AUX port
R1(config)#line aux 0
R1(config-line)#no exec
R1(config-line)#no transport in
R1(config-line)#no transport out
R1(config-line)#exit

! Note : CoPP/CPPr for NTP, ICMP, SHH, etc
Link: Link

! Teardown inactive TCP to or from Router
R1(config)#service tcp-keepalives-in
R1(config)#service tcp-keepalives-out

! Include timestamps in log and debug
R1(config)#service timestamps log datetime
R1(config)#service timestamps debug datetime

! The Auto Secure Script
R1#auto secure

Control Plane Protection (CPPr)

Protecting Router against malicious traffic. ( Spoofed SNMP or SSH Trafic)

! Create Access List Match SNMP and SSH
R1(config)#ip access-list extended LIMIT-ACL
R1(config-ext-nacl)#permit udp any any eq snmp
R1(config-ext-nacl)#permit udp any any eq 22
R1(config-ext-nacl)#exit

! Create Class Map
R1(config)#class-map LIMIT-CLASS
R1(config-cmap)#match access-group name LIMIT-ACL
R1(config-cmap)#exit

! Configure Policy Map
R1(config)#policy-map LIMIT-POLICY
R1(config-pmap)#class LIMIT-CLASS
R1(config-pmap-c)#police rate 64000 bps
R1(config-pmap-c-police)#class class-default
R1(config-pmap-c)#police rate 512000 bps
R1(config-pmap-c-police)#exit
R1(config-pmap-c)#exit
R1(config-pmap)#exit

! Apply to Control Plane Protection
R1(config)#control-plane host
R1(config-cp-host)#service-policy input LIMIT-POLICY
Aug  4 14:31:39.950: %CP-5-FEATURE: Control-plane Policing feature enabled on Control plane host path

! Verify Configuration
R1#show access-lists LIMIT-ACL
Extended IP access list LIMIT-ACL
    10 permit udp any any eq snmp (7377 matches)
    20 permit udp any any eq 22

R1#show class-map
 Class Map match-any class-default (id 0)
   Match any
 Class Map match-all LIMIT-CLASS (id 1)
   Match access-group name LIMIT-ACL

R1#show policy-map control-plane host
 Control Plane Host
  Service-policy input: LIMIT-POLICY
  
    Class-map: LIMIT-CLASS (match-all)
      0 packets, 0 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: access-group name LIMIT-ACL
      police:
          rate 64000 bps, burst 2000 bytes
        conformed 0 packets, 0 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        conformed 0 bps, exceed 0 bps

    Class-map: class-default (match-any)
      0 packets, 0 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: any
      police:
          rate 512000 bps, burst 16000 bytes
        conformed 0 packets, 0 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        conformed 0 bps, exceed 0 bps

Generate and configure Pub Keys

# Linux
ittsm@ittsm:~$ ssh-keygen -t rsa
ittsm@ittsm:~$ cd .ssh 
ittsm@ittsm:~$ less id.rsa.pub

# Windows
Use Puttygen.exe

Public key is this 

AAAAB3NzaC1yc2EAAAABJQABBQEAtPCPybnKR6+wZ4PlG0ktseLZFkBgFYnXyYRn
OMztoNIOOVVqJzHMrIB8JjP3MksAuW1ixfqHfrAxEvx/zU6IE1zxRrEfDp3R8nwr
qvJI7hYJcTLNSag8q63qrCmkz8+0BSwt0xSvsLLFWv63XaD5P5NDZjTws+d0ROhH
QtJaamlrNl3Z9lifsP7Drlsqs40Oh+/9nxlwMvy4XS0hLEVf0PHWmT8TzHPmBCNF
yDzu1KQm6ZhBqn++vW2AV/HvPuTRmXbDpOuEvAVZttnwqVkTgUeX3YS4c0UPQh/1
oVvrSPDEd5sU4ZWEw+pU4KayA8UXQq1QRUGgSZR5L6YH/zXqhw==

! Configure Cisco Router
R1(config)#ip ssh pubkey-chain
R1(config-ssh-pubkey)#username admin
R1(config-ssh-pubkey-user)#key-string
R1(config-ssh-pubkey-data)#$HQtJaamlrNl3Z9lifsP7Drlsqs40Oh+/9nxlwMvy4XS0hLEVf0PHWmT8TzHPmB
R1(config-ssh-pubkey-data)#AAAAB3NzaC1yc2EAAAABJQAAAQEAtPCPybnKR6+wZ4PlG0ktseLZFkBgFYnXyYR
R1(config-ssh-pubkey-data)#0xSvsLLFWv63XaD5P5NDZjTws+d0ROhHQtJaamlrNl3Z9lifsP7Drlsqs40Oh+/
R1(config-ssh-pubkey-data)#RUGgSZR5L6YH/zXqhw==
R1(config-ssh-pubkey-data)#exit
R1(config-ssh-pubkey-user)#end

! Verify 
R1#show run | section ssh
ip ssh time-out 30
ip ssh authentication-retries 5
ip ssh version 2

ip ssh pubkey-chain
 username admin
  key-hash ssh-rsa FC906091283098210300AFFFF098209182BBBB0

Secure Remote Managment

# Secure Remote Managment

Password Length
Local Privilege 15 User
Hide Plain Text Passwords
SSH Support
CCP Support
ACLs For MGMT, Access
Slowing Brute Force Attacks
Clipping Failed Login Attempts

! Change hostname
R2(config)#hostname R1

! Set Domain Name
R1(config)#ip domain-name ITTSM.BLOGSPOT.COM

! Configure minimum length 
R1(config)#security passwords min-length 6

! Verify
R1(config)#username admin privilege 15 secret cisco
% Password too short - must be at least 6 characters. Password configuration failed

R1(config)#username admin privilege 15 secret cisco123

! Configure password ecnryption
R1(config)#service password-encryption

! Generate RSA Key for SSH
R1(config)#crypto key generate rsa modulus 2048 label Our-RSA-Keys
The name for the keys will be: Our-RSA-Keys

% The key modulus size is 2048 bits
% Generating 2048 bit RSA keys, keys will be non-exportable...[OK]

! Configure SSH version 2
R1(config)#ip ssh version 2

! Specify SSH time-out interval
R1(config)#ip ssh time-out 30

! Configure Number of authentication retries
R1(config)#ip ssh authentication-retries 5

! Verify 
R1#show crypto key mypubkey rsa
% Key pair was generated at: 15:26:48 UTC Aug 1 2014
Key name: Our-RSA-Keys
 Storage Device: not specified
 Usage: General Purpose Key
 Key is not exportable.
 Key Data:
  30820122 300D0609 2A864886 F70D0101 01050003 82010F00 3082010A 02820101
  00B3C0A7 4D666BB7 049F8EE5 4F18C21C 3CD75CC8 06B1754F A6D9E032 EE1785EB
  85BDD919 2716AAC1 98E1FD52 7CF5E5FA B212B1E4 5B2BBCD2 25713425 3985A811
  1C1D4F64 ADAF962F 3B56633A C1CC5FAF 9A3B955B CFE4F2AC FF1C6671 4F91CFA1
  CD59F9D5 DE2F3D91 3E3E1AAD 01650911 9943637C 5B276035 916169BD C76EB0A5
  E0F38C51 1E581075 4F27F1AE F53AF354 7C3193BB 643FA924 B15094BD 8832091C
  D3F4F3B4 4BE5347A 7380BAF7 C3F43220 9522DE1B EEEB010E 428DA541 03874FC8
  EC7F167B 20032F79 3524BD50 4A8BAF05 24B3825A 17ED4D42 BE1370D4 0CC2FA6C
  2E50733B FEA43F05 4011E2B9 9869135F F2E867B9 4E820D42 9C0113C3 EB98C2EE
  C9020301 0001
% Key pair was generated at: 15:26:49 UTC Aug 1 2014
Key name: Our-RSA-Keys.server
Temporary key
 Usage: Encryption Key
 Key is not exportable.
 Key Data:
  307C300D 06092A86 4886F70D 01010105 00036B00 30680261 00CBFEF5 E8FACB24
  DFB6BE5C 79FA940E 170FE136 5EA9EBC8 6E8A7B72 8B2D34BC 665AF8A6 CC6E2907
  91FC4FC0 556667E2 A00F8053 DF7C5436 05012901 CB49D16D 3793E4A3 8B1A7384
  D3CF90F8 7DD47CA8 B83F13B8 B9DD0AB3 36E8095C 8AFB5C1C 6B020301 0001
  
! Allow only HTTPS Access  
R1(config)#no ip http server
R1(config)#ip http secure-server

! Password needed to access
R1(config)#ip http authentication local

! Create permitted host Access List  
R1(config)#ip access-list standard 5
R1(config-std-nacl)#permit host 10.1.0.25
R1(config-std-nacl)#permit host 192.168.1.129
R1(config-std-nacl)#deny any log
R1(config-std-nacl)#exit

! Apply Security Access list to access HTTPS
R1(config)#ip http access-class 5 
  
! Configure VTY Lines and Apply Security Access list
R1(config)#line vty 0 15
R1(config-line)#transport input ssh
R1(config-line)#login local
R1(config-line)#access-class 5 in
R1(config-line)#exit

! Set delay between successive fail login (Seconds)
R1(config)#login delay 5

! Slow down Brute-Force Attack
R1(config)#login block-for 30 attempts 3 within 60
*Note : More details about Login Here

Change ssh Port

#Configure SSH on Cisco
router(config)# hostname R1
R1(config)# ip domain name ITTSM.BLOGSPOT.COM
R1(config)# crypto key generate rsa
The name for the keys will be: R1.ITTSM.BLOGSPOT.COM
Choose the size of the key modulus in the range of 360 to 2048 for your
  General Purpose Keys. Choosing a key modulus greater than 512 may take
  a few minutes.
How many bits in the modulus [512]: 1024
% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]
#Create User
R1(config)# username root privilage 15 secret Georgia
R1(config)# line vty 0 4
R1(config-line)# login local

Now, we will configure the router to expect ssh connections on port 4009. This is done with the command ip ssh port and applying a rotary group. Then, that rotary group is configured on the VTY lines:

#Change Port and configure rotary group
R1(config)# ip ssh port 4009 rotary 22
R1(config)# line vty 0 4
R1(config-line)# rotary 22

#Verify 
Switch#ssh -l root -p 4009 192.168.1.10
Password:******
R1#show tcp brief
TCB       Local Address           Foreign Address        (state)
651B9D18  192.168.1.10.4009       192.168.1.130.51741    ESTAB

root@bt:~# ssh 192.168.1.10 -p 4009
Password:******
R1#show tcp brief
TCB       Local Address           Foreign Address        (state)
64FBEA1C  192.168.1.10.4009       192.168.1.5.56392      ESTAB

Secure VTY Access in CISCO

#Password configuration 8 characters at least
R1(config)#security passwords min-length 8
R1(config)#username root privilege 15 secret cisco
% Password too short - must be at least 8 characters. Password configuration failed
R1(config)#username root privilege 15 secret cisco123

#Block Access 100 Sec if 3 attempts Failed in 60 sec
R1(config)#login block-for 100 attempts 3 within 60
*Mar  1 00:16:19.783: %SEC_LOGIN-1-QUIET_MODE_ON: Still timeleft for watching failures is 47 secs, [user: root] [Source: 10.0.10.25] [localport: 22] [Reason: Login Authentication Failed] [ACL: sl_def_acl] at 00:16:19 UTC Fri Mar 2 20013

*Note: In the QUIET MODE nobody can access this Router.

#Configure Access for only One Host When router is in Quiet-Mode.
R1(config)#access-list 1 permit host 10.0.10.254
R1(config)#login quiet-mode access-class 1
*Note: Only 10.0.10.254 will be permited
R1#show login
     A default login delay of 1 seconds is applied.
     Quiet-Mode access list 1 is applied.
     Router enabled to watch for login Attacks.
     If more than 3 login failures occur in 60 seconds or less,
     logins will be disabled for 100 seconds.
     Router presently in Normal-Mode.
     Current Watch Window
         Time remaining: 29 seconds.
         Login failures for current window: 0.
     Total login failures: 6.

R1#show login
     A default login delay of 1 seconds is applied.
     Quiet-Mode access list 1 is applied.
     Router enabled to watch for login Attacks.
     If more than 3 login failures occur in 60 seconds or less,
     logins will be disabled for 100 seconds.
     Router presently in Quiet-Mode.
     Will remain in Quiet-Mode for 77 seconds.
     Restricted logins filtered by applied ACL 1.

R1#show login failures
Total failed logins: 6
Detailed information about last 50 failures
Username        SourceIPAddr    lPort Count TimeStamp
root            10.0.10.25      22    6     00:24:00 UTC Fri Mar 1 2002

#Configure Login Penalty to 10 secs (I must wait 10 sec after fail password)
R1(config)#login delay 10

#Log any time when you fail Login 
R1(config)#login on-failure log
*Mar  1 00:32:09.763: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: cisco] [Source: 10.0.10.25] [localport: 22] [Reason: Login Authentication Failed] at 00:32:09 UTC Fri Mar 2 20013

Restrict SSH Linux

# /etc/hosts.allow

Variant 1

sshd:  192.168.1.0/24

Variant 2

sshd: 111.11.1.111, 222.2.22.222, 333.3.33.333

Variant 3 (with sshdfwd-X11):

sshd,sshdfwd-X11: 192.168.1.0/24

# /etc/hosts.deny

Variant 1

sshd: ALL

Variant 2

sshd,sshdfwd-X11: ALL