路由器速查表.docVIP

路由器安全配置速查表来源: FUMTEK Blog 作者: FUMTEK Specific Recommendations: Router Access 1. Shut down unneeded services on the router. Servers that are not running cannot break. Also, more memory and processor slots are available. Start by running the show proc command on the router, then turn off clearly unneeded facilities and services. Some servers that should almost always be turned off and the corresponding commands to disable them are listed below. Small services (echo, discard, chargen, etc.) no service tcp-small-servers no service udp-small-servers BOOTP - no ip bootp server Finger - no service finger HTTP - no ip http server SNMP - no snmp-server2. Shut down unneeded services on the routers. These services allow certain packets to pass through the router, or send special packets, or are used for remote router configuration. Some services that should almost always be turned off and the corresponding commands todisable them are listed below. CDP - no cdp run Remote config. - no service config Source routing - no ip source-route3. The interfaces on the router can be made more secure by using certain commands in the Configure Interface mode. These commands should be applied to every interface. Unused interfaces - shutdown No Smurf attacks - no ip directed-broadcast Mask replies - no ip mask-reply Ad-hoc routing - no ip proxy-arp4. The console line, the auxiliary line and the virtual terminal lines on the router can be made more secure in the Configure Line mode. The console line and the virtual terminal lines should be secured as shown below. The Aux line should be disabled, as shown below, if it is not being used. Console Line - line con 0exec-timeout 5 0login Auxiliary Line - line aux 0no execexec-timeout 0 10transport input none VTY lines - line vty 0 4exec-timeout 5 0logintransport input telnet ssh5. Passwords can be configured more securely as well. Configure the Enable Secret password, which is protected with an MD5-based algorithm