Printable View
I have a newbie-ish question to toss out.
If I am in my Cisco Router, and there are three users telnetting into the same router, one of which is causing problems by changing configurations, is there a way to boot that specific user selectively, and ban him from telnetting back into the router?
-Thanks!
Aphim
The hopeless CCNA Student
Uhhh... Change the password?
There are other things you can do, since I am unsure of exactly what model etc., I can only give general ideas.
1. Depending on your network configuration you can disable remote administration.
2. Change the password
I would also restrict how many people can log into the router.
I only allow one connection at a time.... and only through ssh, so they can't sniff UIDs and PWD.
Also, you can use the disconnect command
Also, create ACLs that specify who can connect to it. You can do this by ip, subnet, network, etc.Quote:
router#who
Line User Host(s) Idle Location
* 1 vty 0 username idle 00:00:00 somepc
Interface User Mode Idle Peer Address
Vi1 PPPoE 00:00:07 10.10.10.10
router#disconnect vty 0
I'd change the password, and then create and ACL that does not let that users MAC address touch your router.
If you're at the console, how about creating an ACL to block port 25? If you're also telnetting in, then once you're in, disable the others.
Or go even further, connect the router to a TACACS server or RADIUS one and use that to authenticate users against the router, this will allow you to assign logins to each user, thus removing the need to all use the same account (which it sounds like you are doing) and also providing a secure login mechanism (as its encrypted).
Quote:
Originally posted here by Aphim
I have a newbie-ish question to toss out.
If I am in my Cisco Router, and there are three users telnetting into the same router, one of which is causing problems by changing configurations, is there a way to boot that specific user selectively, and ban him from telnetting back into the router?
-Thanks!
Aphim
The hopeless CCNA Student
you can use this line as an example to block a particular IP from accessing your router via telnet
access-class 51 deny 0.0.0.0 255.255.255.255
access-class 52 permit (ip)
line aux 0
access-class 51 in
line vty 0 4
access-class 52 in
i hope this helps
keep in mind though that if you only tie it down to an IP then all the user needs to do is spoof one of the valid IPs, which they can do easily if you are all on the same LAN, so some kind of password change is a better option.
If they are going in and "changing settings" etc, why even allow them the access to begin with?
I'm sure you meant port 23. Port 25 is SMTP.Quote:
Originally posted here by rufus47
If you're at the console, how about creating an ACL to block port 25? If you're also telnetting in, then once you're in, disable the others.
But anywayz...How many routers/switches do you have? If you need to administer a couple of them have you looked at TACACS? That way you can give everybody (that needs it) his/her own account/password and regulate who can do what.