Chapter 3
Regular Password Changes
Most administrators agree that regular password changes on devices are a good security practice.
Most honest administrators will admit that they don't do so. Simply put, changing the device
passwords--or SNMP community strings, which serve a similar function--on dozens of devices
can take too long, is too error-prone, and creates too much confusion in the support staff.
Utilities are required. Ideally, if you've already implemented a centralized device-management
solution, you have the necessary tools. Most solutions can push device changes out to as many
devices as necessary, ensuring that passwords are changed properly, consistently, and on
schedule. Some management solutions provide a centralized management UI, removing the need
to log on to the devices directly. Thus, you won't need to inform support staff of a password
change; only the management solution needs to know. Coupled with role-based security,
management solutions can offer more effective device security simply because they make it
more feasible to observe long-standing industry best practices.
Templates for Consistency and Compliance
Consistency can improve both security and maintenance activities for network devices. For
example, consider the partial configuration file from a Cisco AS2509 access server that Listing
3.1 shows.
!
version 11.3
service timestamps debug datetime msec localtime
no service udp-small-servers
service tcp-small-servers
!
hostname 2500-DialOut
!
enable secret 5 $1$WG3K$8Zhlh6hx4U3U2KFPyW0
enable password abc
!
ip domain-name company.com
ip name-server 10.0.0.0
ip address-pool local
!
interface Ethernet0
ip address 10.0.0.1 255.255.255.0
no ip mroute-cache
no ip route-cache
no lat enabled
no mop enabled
!
interface Serial0
no ip address
no ip mroute-cache
no ip route-cache
shutdown
!
interface Serial1
no ip address
no ip mroute-cache
no ip route-cache
shutdown
57
Summary :
ip domain-name company.com ip name-server 10.0.0.0 ip address-pool local ! interface Ethernet0 ip address 10.0.0.1 255.255.255.0 no ip mroute-cache no ip route-cache no lat enabled no mop enabled ! interface Serial0 no ip address no ip mroute-cache no ip route-cache shutdown !
Tags :
deices,password,management,security,interface,too,address,serice,changes,routecache,mroutecache,deice,solutions