White Papers

45 Security................................................................................................................................................... 769
AAA Accounting.............................................................................................................................................................769
Conguration Task List for AAA Accounting........................................................................................................ 769
AAA Authentication........................................................................................................................................................ 771
Conguration Task List for AAA Authentication...................................................................................................772
Obscuring Passwords and Keys................................................................................................................................... 775
AAA Authorization......................................................................................................................................................... 775
Privilege Levels Overview....................................................................................................................................... 775
Conguration Task List for Privilege Levels.......................................................................................................... 776
RADIUS........................................................................................................................................................................... 780
RADIUS Authentication...........................................................................................................................................780
Conguration Task List for RADIUS....................................................................................................................... 781
Support for Change of Authorization and Disconnect Messages packets...................................................... 785
TACACS+........................................................................................................................................................................794
Conguration Task List for TACACS+................................................................................................................... 794
TACACS+ Remote Authentication.........................................................................................................................796
Command Authorization......................................................................................................................................... 797
Protection from TCP Tiny and Overlapping Fragment Attacks................................................................................797
Enabling SCP and SSH..................................................................................................................................................797
Using SCP with SSH to Copy a Software Image.................................................................................................798
Removing the RSA Host Keys and Zeroizing Storage ........................................................................................799
Conguring When to Re-generate an SSH Key ..................................................................................................799
Conguring the SSH Server Key Exchange Algorithm.......................................................................................800
Conguring the HMAC Algorithm for the SSH Server.......................................................................................800
Conguring the HMAC Algorithm for the SSH Client......................................................................................... 801
Conguring the SSH Server Cipher List................................................................................................................801
Conguring the SSH Client Cipher List................................................................................................................ 802
Secure Shell Authentication................................................................................................................................... 802
Troubleshooting SSH...............................................................................................................................................805
Telnet...............................................................................................................................................................................805
VTY Line and Access-Class Conguration.................................................................................................................805
VTY Line Local Authentication and Authorization...............................................................................................806
VTY Line Remote Authentication and Authorization.......................................................................................... 806
VTY MAC-SA Filter Support.................................................................................................................................. 807
Role-Based Access Control..........................................................................................................................................807
Overview of RBAC.................................................................................................................................................. 808
User Roles................................................................................................................................................................. 810
AAA Authentication and Authorization for Roles................................................................................................. 813
Role Accounting........................................................................................................................................................816
Display Information About User Roles....................................................................................................................816
Two Factor Authentication (2FA).................................................................................................................................818
Handling Access-Challenge Message....................................................................................................................818
Conguring Challenge Response Authentication for SSHv2..............................................................................818
SMS-OTP Mechanism.............................................................................................................................................819
Conguring the System to Drop Certain ICMP Reply Messages.............................................................................819
Contents
25