the cisco device hardening baseline every router should ship with

the router that's still running on factory defaults is not your friend

if you've ever pulled up a cisco device that's been humming along in a closet for three years untouched, you know the feeling. default creds, telnet wide open, no password encryption, console access wide open to anyone who plugs in. it works, sure, but it's also the network equivalent of leaving your front door open with a sign that says "valuables inside." here's the six step baseline that turns that box from low-hanging fruit into something an attacker has to actually work for.

step one and two: real credentials, not placeholders

the first sin is leaving a blank or default enable password, or worse, using "cisco" as both username and password because that's what the lab guide said. fix that immediately.

username admin secret YourStrongPassphraseHere
enable secret YourOtherStrongPassphraseHere

notice it's secret, not password. secret hashes the value, password just obfuscates it with reversible encoding. always pick secret when you have the choice.

step three: kill telnet, set up ssh properly

telnet sends everything, including your password, in plaintext. anyone with a packet capture on the wire reads it like a postcard. ssh fixes that, but it needs some setup first.

ip domain-name yourdomain.local
crypto key generate rsa modulus 2048

the domain name is required because ssh keys are generated using the hostname and domain together. the 2048-bit modulus is the current sane minimum, anything smaller is asking to be brute forced eventually. once the key exists, ssh is available as a management protocol.

step four: aaa new-model and locking down the vty lines

aaa new-model turns on cisco's authentication, authorization, and accounting framework. even if you're just using local login for now, turning this on is what lets you cleanly bolt on radius or tacacs+ later without rearchitecting your access control.

aaa new-model
line vty 0 15
 transport input ssh
 login local
 exec-timeout 5 0

transport input ssh is the line that actually kills telnet on the vty lines, it tells the device to only accept ssh connections for remote management, full stop. login local makes sure whoever connects has to authenticate against a real local username, not just a shared line password. exec-timeout 5 0 kicks out idle sessions after five minutes, so a forgotten terminal window sitting open on someone's desk doesn't become a standing invitation.

step five: throttle brute force attempts

ssh only isn't enough if someone can hammer the login prompt as many times as they want. login block-for adds a cooldown after repeated failures.

login block-for 120 attempts 3 within 60

read that as: if there are 3 failed login attempts within 60 seconds, lock out login attempts for 120 seconds. it's a simple rate limiter, but it turns brute forcing from "run a script overnight" into "wait around forever," which is usually enough to make an attacker move on.

step six: encrypt what's sitting in the config file

by default a bunch of passwords in the running config are stored in plaintext, meaning anyone who gets a copy of your config file (backup server, tftp capture, misconfigured git repo, take your pick) gets your passwords too.

service password-encryption

this isn't strong encryption, it's a weak cipher, but it stops the trivial plaintext leak and covers the easy cases. it's not a substitute for secret hashing on your main passwords, it's a floor, not a ceiling.

the takeaway

none of these six steps are exotic. no special licensing, no third party tools, just ios commands most engineers have typed a hundred times. the point isn't that this makes a device unhackable, nothing does. the point is that it removes the easy wins: plaintext protocols, blank credentials, unthrottled login attempts, and passwords sitting around in plaintext config files. go audit your own gear this week. run show running-config on something you manage and check it against this list. if telnet is still enabled or there's no password encryption, that's your homework for today.