It's good security practice to disable unused services on your network devices, in other words,
if you have services enabled on network devices that you're not using, that's a potential vulnerability
that hackers can leverage.
Cisco ship routers and switches with a default set of services enabled, which are considered to be
appropriate for most network deployments.
However, that may be different in some of your networks, so you should disable unnecessary services.
As an example, Cisco Discovery Protocol, or CDP is enabled by default on most Cisco devices.
So unless you require that, disable it, especially on Internet facing interfaces, by disabling unneeded
services, you preserve resources on your network devices as well as reduce the attack area of your
network devices.
In other words, there are fewer opportunities for hackers to hack.
In this example, I've got two Cisco routers running with in GNS3, which in turn are connected
to a hub, which in turn is connected to a cloud which connects GNS3 to my physical network.
So let's look at the services on router 1 and router 2 and see what we can learn about the network.
So on router 1 show control plane,
host,
open ports will show us which ports are active on this router.
So in other words, in this example, the route is listening for Telnet sessions to TCP Port 23.
That's a default config on router 1, on router 2 of enabled various services.
So show control
playing host open ports shows us that this routers listening on TCP Port 23, in other words telnet,
DNS has been enabled, so it's listing on TCP and UDP, Port 53 HTP has been enabled and so has the DHCP
service.
If those services are not required, you should disable them, show CDP neighbors shows us CDP information.
So we can see as an example out of FastEthernet 01
there's a Cisco Unified communications manager running within VMware. There's a 3750 switch,
there are two IP phones as well as a router, router 1 connected on FastEthernet 00, as well as
router 2.
Now, because of non Cisco devices used in the topology, the router may actually be seeing itself where
CDP messages are forwarded by other switches in the topology. Router
1 is available on FastEthernet 00.
So firstly, we could launch attacks on the router using various ports that are open here, including
Port 80.
So as an example, I'll telnet to router 2 on this IP address
on Port 80
and notice, the connection has been opened. I'll press control C and you can see that the Cisco
iOS server has now closed the connection.
but the point is I could launch an attack on the router on Port 80,
Port 23 is also open, in other words, telnet,
So is Port 53 noticed the connection is open, but there has been closed.
I've also enabled another port on the router so I can use the command telnet to the IP address, questionmark,
and I can see a list of various port numbers, including the character Generation Port 19.
This is not something you want to enable on a router.
What it's doing here is getting the router to generate characters, which uses up the CPU of the router.
I hear it's not showing a lot of use, but the point is by doing this.
We're trying to use up CPU cycles, and that's not something you typically want to enable on a router
so I could, as an example, open up multiple sessions to that router
and load it.
Show session shows me that I have three sessions open to the router
and on this router we can look at the open ports and notice Port 19 is established three times on
this router, there are three character generation sessions open to the router at the moment if telnet
was enabled on the router.
This router could telnet to Port 23 and log in.
It's actually a lot slower than it was previously.
Show sessions shows me that I'll have full sessions open to the router.
In the output we can see, telnet session is listening
but we can also see a telnet session established, as well as the charge in sessions that I established.
So as an example, if I resume session one, that's the character generation that's taking place on
the first session.
Once again, from a security point of view, you want to lock down or remove unneeded services.
There's no reason to have these services enabled on a router today.
So no service, TCP small service
and UDP small service, we want to disable those.
Sessions are still established at the moment, so what I'll do is disconnect all my sessions.
Those charged in ports have been removed, and now if we try and telnet back to the router using the charge
in port, that connection is refused.
That's port 19 notice,
it's refused.
Port 80 is still open.
Using the Cisco iOS server, so unless you want an HTTP server enabled and generally you do not, let me
just do a search for the command to show you.
So in the running-config, we've got the HTTP server enabled, but the secure HTTP server is disabled,
in other words, HTTPS is disabled and HTTP is enabled.
You don't want that.
Once again, HTTP is clear text.
HTTP is not secure, so you typically want to turn it off.
It's recommended that you do not run the service.
You may want to run the secure server or SSL server, or HTTPS server
but generally, unless there's a requirement, you want to turn off the HTTP service.
Now, why is the router running a DNS service?
There's no reason to do that.
Before I disable that, notice the change now when I try and telnet to port 80.
The connection is refused, whereas previously that connection was opened.
So once again, there's no real reason to run
a DNS server in production on a router, you need to have a very good reason for doing that.
So I'm going to turn off the DNS service.
That port is now removed
and once again, unless required, disable DHCP, so do show run.
We can see a DHCP pool was created, so I'm going to disable that
and now when we look at the open ports, we can see that only telnet is enabled.
Generally, you don't want to use Telnet, you should be using SSH because Telnet is insecure
we can see that by doing a Wireshark capture.
Telnet sends packets and clear text, which is not good.
It may be OK in an internal network, but it's recommended that you use SSH because I can simply
capture your password.
Off the wire, so there the router is asking for the password
and if we scroll down
here's the password CIS
CO and if we just look at that session, so follow the TCP stream, we'll be able to see the password,
make that a bit bigger.
So you can see the mistake I made and then the password I actually entered when logging into the rauda.
There's the VTY password and here's the enable password or secret password on the router, all shown
in clear text.
So Telnet isn't an ideal way to manage networks because of the security risks, once again, show control
hyphen plane hosts open ports shows you which ports are open on the router.
Also, have a look at show run to see if any services have been enabled that shouldn't be enabled on
your router.
So at the moment, this looks better.
We're not seeing any strange services enabled.
The command service allows you to see various services that could be enabled on a router TCP small servers
allowed me to use the character generation on a router, make sure that that and this are disabled.
They are disabled by default these days
but just be aware that someone may have enabled various services on your router.
So, again, use the show control plane, host open ports to check which ports are open on the router
or other network device.