Security Fundamentals Intermediate ~6 min

Secure VTY lines for SSH only

On R1, add a local user admin with secret Cisco123!, turn on service password-encryption so any residual clear-text passwords in the config get obfuscated, then lock down line vty 0 4 to accept only SSH and authenticate via the local username database.

Topology

Objectives

○User admin secret Cisco123!
○VTY transport input ssh
○VTY login local
○service password-encryption is on
○ip domain-name set (SSH key generation requires it)

Hints

Hint 1 — SSH prereqs

Before SSH will accept a session, IOS wants a hostname (not "Router"), a domain-name, and RSA keys. Set the domain-name here; you can add crypto key generate rsa as a bonus step.

Hint 2 — why service password-encryption

This turns any plaintext line/enable password into Cisco type-7. Reversible, but at least not shoulder-surfable. Use it on top of enable secret and username … secret (type-9), not as a substitute.

Hint 3 — full sequence

enable
configure terminal
 ip domain-name lab.local
 username admin secret Cisco123!
 service password-encryption
 line vty 0 4
  transport input ssh
  login local
  end

← Previous task

DHCP snooping + Dynamic ARP Inspection

Security Fundamentals · ~6 min

Next task →

Port Security + IP Source Guard

Security Fundamentals · ~6 min