Security Fundamentals Intermediate ~6 min

Secure VTY lines for SSH only

On R1, add a local user admin with secret Cisco123!, turn on service password-encryption so any residual clear-text passwords in the config get obfuscated, then lock down line vty 0 4 to accept only SSH and authenticate via the local username database.

Topology

Objectives

○User admin secret Cisco123!
○VTY transport input ssh
○VTY login local
○service password-encryption is on
○ip domain-name set (SSH key generation requires it)

Hints

Hint 1, SSH prereqs

Before SSH will accept a session, IOS wants a hostname (not "Router"), a domain-name, and RSA keys. Set the domain-name here; you can add crypto key generate rsa as a bonus step.

Hint 2, why service password-encryption

This turns any plaintext line/enable password into Cisco type-7. Reversible, but at least not shoulder-surfable. Use it on top of enable secret and username … secret (type-9), not as a substitute.

Hint 3, full sequence

enable
configure terminal
 ip domain-name lab.local
 username admin secret Cisco123!
 service password-encryption
 line vty 0 4
  transport input ssh
  login local
  end

← Previous task

DHCP snooping + Dynamic ARP Inspection

Security Fundamentals · ~6 min

Next task →

Port Security + IP Source Guard

Security Fundamentals · ~6 min

Stuck on a lab, or not sure what to practice next?

Talk it through with a mentor on a free 20-minute call. We look at your lab, your exam date and your weak spots, and you leave with a plan.

Book free session

Cisco Mentorship

CompTIA Foundation

Firewall Security

Short Courses

More

CCNA v1.1

CCNA v2.0

CCNA Automation

CCNP

Network+

NSE 4

Lab Tasks

Videos

Packet Tracer Labs

Simulators

Secure VTY lines for SSH only

Stuck on a lab, or not sure what to practice next?