Skip to content
Log in Sign up My account

5.1.a Lines, Passwords and Local User Authentication

Blueprint 5.1: Configure and verify device access control

  • 5.1.a Lines and local user authentication
  • (5.1.b Authorization and accounting using AAA is on the AAA page)

Device access control answers two questions: how can someone reach the command line (console, auxiliary port, Telnet, SSH) and who is allowed in once they get there. This page covers the building blocks that work without any server: lines, passwords, local user accounts, privilege levels and SSH. The AAA page then moves the "who" decision to TACACS+ or RADIUS.

You already manage routers every day, so most of this will feel familiar. The exam focuses on the details that people get wrong in production: which password types are reversible, what login versus login local actually checks, why SSH silently fails, and how transport input and access-class interact.

Lines: the ways into the CLI

Every CLI session is attached to a line. IOS XE has three kinds.

Line Command What connects to it Typical count
Console line con 0 Serial cable or a console server 1
Auxiliary line aux 0 Modem or out-of-band terminal server (not on every platform) 0 or 1
Virtual terminal line vty 0 4 (and often 5 15 or higher) Telnet and SSH sessions over IP 5 to 16 or more, platform dependent

Things that live under a line:

Command Purpose
password <pw> Line password, used only with plain login
login Authenticate with the line password
login local Authenticate against the local username database
login authentication <list> Use an AAA method list (needs aaa new-model)
transport input ssh Which protocols may open an inbound session (VTY)
access-class <acl> in Which source addresses may open a session (VTY)
exec-timeout <min> <sec> Idle timeout. Default 10 minutes. 0 0 disables it
privilege level <0-15> Privilege level users land in on this line
logging synchronous Stops log messages from breaking up what you type 
graph LR
  ADM["Admin laptop"] -- "Serial" --> CON["line con 0"]
  NOC["NOC host 192.168.100.10"] -- "SSH TCP 22" --> ACL{"access-class<br/>permits source?"}
  ACL -- "no" --> REF["Connection refused"]
  ACL -- "yes" --> TR{"transport input<br/>allows SSH?"}
  TR -- "no" --> REF
  TR -- "yes" --> VTY["line vty 0 4"]
  VTY --> AUTH{"login method"}
  CON --> AUTH
  AUTH --> EXEC["EXEC at privilege level"]

Exam trap

The number of VTY lines differs between platforms and releases. If show running-config | section line vty shows line vty 0 4 and line vty 5 15, every command (transport, access-class, login method) must be applied to both ranges. An attacker only needs the one range you forgot.

Password types

IOS stores passwords and secrets as numbered types. The number appears in the running configuration in front of the value, for example enable secret 9 $9$....

Type Algorithm Reversible? How you get it Verdict
0 Clear text Yes, it is plain text password with no encryption service Never use
4 SHA-256, single iteration, no salt (flawed implementation) No, but weak Older releases only Deprecated, removed from current IOS XE
5 Salted MD5 No secret on older releases, or secret 5 <hash> Weak against modern cracking hardware
6 AES, with a master key Yes, with the master key key config-key password-encrypt plus password encryption aes Used for keys the device must recover (for example some server keys), not for logins
7 Cisco Vigenere-style obfuscation Yes, trivially service password-encryption Hides passwords from a shoulder surfer only
8 PBKDF2 with SHA-256 No algorithm-type sha256 secret Good
9 scrypt No algorithm-type scrypt secret Recommended

Two kinds of storage matter:

  • A secret is hashed. The device can check a password against it but cannot recover the original. Use secrets for every login and for enable.
  • A password is either clear text or reversible. service password-encryption turns type 0 values into type 7, which anyone can decode with a free tool. Shared keys that the device must actually send (for example a TACACS+ key) must be reversible, which is why type 6 exists.
enable algorithm-type scrypt secret En@ble-Str0ng
username netadmin privilege 15 algorithm-type scrypt secret N3t-Adm1n!
security passwords min-length 10
service password-encryption        ! still useful for any remaining type 0 values

! Paste a hash copied from another device. The value is not re-hashed.
username netadmin privilege 15 secret 9 $9$<salt>$<hash>

key config-key password-encrypt Master-K3y-Only-On-This-Box
password encryption aes
! Supported keys (for example under tacacs server or radius server)
! are now stored as type 6 instead of type 0 or 7.

Exam trap

service password-encryption does not make a password secure. It produces type 7, which is reversible. If a question asks which option stores a credential with a one-way hash, the answer uses secret (types 5, 8 or 9), never password with an encryption service.

Which hash secret uses when you do not name an algorithm depends on the release (older releases produce type 5, newer ones may produce type 9). On the exam and in production, name the algorithm explicitly so the result is not a surprise.

enable password and enable secret together

If both exist, enable secret wins and enable password is ignored. IOS warns you if you try to set them to the same value.

Line password versus local users

line vty 0 4
 password Sh@red-Pass
 login

Everyone types the same password. No username, no accountability, and the password is stored as type 0 or 7.

username netadmin privilege 15 algorithm-type scrypt secret N3t-Adm1n!
username helpdesk privilege 1 algorithm-type scrypt secret H3lp-D3sk!
!
line vty 0 4
 login local

Each person has a username and their own hashed secret. The login is recorded under their name in show users and syslog.

aaa new-model
aaa authentication login VTY-AUTH group TAC-SERVERS local
line vty 0 4
 login authentication VTY-AUTH

Covered on the AAA page. Once aaa new-model is on, login and login local under the lines are no longer used.

Exam trap

login with no password configured on a VTY line refuses every connection with "Password required, but none set". login local with no username defined also locks everyone out. Both are favourite "why can't the admin connect?" exhibits.

Privilege levels

IOS has 16 privilege levels, 0 to 15.

Level Meaning
0 Only disable, enable, exit, help and logout
1 User EXEC (> prompt). Default for a new session
2 to 14 Custom levels. Empty until you move commands into them
15 Privileged EXEC (# prompt). Everything

A user moves between levels with enable <level>, which asks for that level's enable secret, or lands directly at a level set on the username (when authorization allows it, see AAA) or on the line.

! Help desk staff land in level 7 and can run a few extra commands
privilege exec level 7 show running-config
privilege exec level 7 clear counters
enable algorithm-type scrypt secret level 7 L3vel-7-Pass
username helpdesk privilege 7 algorithm-type scrypt secret H3lp-D3sk!

R1> enable 7
Password:
R1# show privilege
Current privilege level is 7

Exam trap

A user at a custom level who is allowed show running-config sees only the configuration lines for commands that are also available at their level. The output looks almost empty. That is expected behaviour, not a bug, and it is a common way to show "why does this user see so little?"

Custom privilege levels are hard to manage at scale. Per-command authorization with TACACS+ (AAA page) is the scalable replacement and is what the exam expects you to recommend for large environments.

SSH

Telnet sends everything, including the password, in clear text. SSH version 2 encrypts the session. IOS XE needs four things before it will accept SSH:

  1. A hostname that is not the default Router (or Switch).
  2. A domain name (ip domain name), because the default RSA key label is hostname.domain.
  3. An RSA key pair. 2048 bits is the practical minimum today. SSH version 2 needs at least 768 bits.
  4. A login method on the VTY lines, and transport input that allows SSH.
hostname R1
ip domain name encor.lab
crypto key generate rsa modulus 2048
ip ssh version 2
ip ssh time-out 60
ip ssh authentication-retries 3
!
username netadmin privilege 15 algorithm-type scrypt secret N3t-Adm1n!
!
ip access-list standard MGMT-ONLY
 permit 192.168.100.0 0.0.0.255
!
line vty 0 4
 login local
 transport input ssh
 access-class MGMT-ONLY in
 exec-timeout 10 0
line vty 5 15
 login local
 transport input ssh
 access-class MGMT-ONLY in
 exec-timeout 10 0

Generating the key enables the SSH server. Deleting it (crypto key zeroize rsa) disables SSH again.

Protecting the login itself

Command Effect
login block-for 120 attempts 5 within 60 After 5 failures within 60 seconds, refuse all logins for 120 seconds (quiet mode)
login quiet-mode access-class MGMT-ONLY During quiet mode, still accept logins from this ACL so admins are not locked out
login delay 2 Wait 2 seconds between login attempts
login on-failure log / login on-success log Send syslog messages for failed and successful logins
banner login ^C Authorized access only ^C Legal warning before the username prompt

Exam trap

access-class uses an IP ACL, but it filters sessions to the lines, not packets through interfaces. access-class MGMT-ONLY in under the VTY lines limits who can open a session to the router. access-class MGMT-ONLY out limits where a user already on the router can Telnet or SSH to. Putting the same ACL on an interface with ip access-group filters all traffic, including transit traffic.

Verification

R1# show ip ssh
SSH Enabled - version 2.0
Authentication methods:publickey,keyboard-interactive,password
Authentication timeout: 60 secs; Authentication retries: 3
...
R1# show crypto key mypubkey rsa
% Key pair was generated at: 10:14:02 UTC Oct 7 2026
Key name: R1.encor.lab
Key type: RSA KEYS
 Storage Device: private-config
 Usage: General Purpose Key
 Key is not exportable.
 Key Data:
  ...
R1# show users
    Line       User       Host(s)              Idle       Location
*  0 con 0                idle                 00:00:00
   2 vty 0     netadmin   idle                 00:00:41 192.168.100.10
R1# show ssh
Connection Version Mode Encryption  Hmac         State          Username
0          2.0     IN   aes256-ctr  hmac-sha2-256 Session started netadmin
0          2.0     OUT  aes256-ctr  hmac-sha2-256 Session started netadmin
R1# show line vty 0 | include Allowed|Access
Allowed input transports are ssh.

Output is trimmed and the line numbers, ciphers and exact wording vary by release. The lines to look for: SSH version 2.0 enabled, a key named after hostname and domain, the user and source address in show users, and ssh as the only allowed input transport.

Symptom Likely cause Check
SSH refused, Telnet works transport input telnet, or no RSA key show line vty 0, show ip ssh
"Please define a domain-name first" when generating keys No ip domain name show run \| include domain
Connection refused from one subnet only access-class does not permit it show access-lists MGMT-ONLY (watch the counters)
Password prompt accepts nothing login local with no matching user, or wrong case show run \| include username
Login lands at > not # User privilege is 1, or AAA exec authorization not configured show privilege

Lab: harden local access on R1

Topology: R1 (Catalyst 8000v) with Gi1 on the management LAN 192.168.100.0/24 (R1 is .1) and Gi2 on the user LAN 10.10.10.0/24. Use the Host1 Ubuntu node on the management LAN at 192.168.100.10 and an IOSv with no ip routing as a user PC at 10.10.10.10. See Lab Setup for images.

  1. Save a baseline: copy running-config flash:baseline.cfg.
  2. Configure a line password on the VTY lines with plain login and Telnet allowed. Connect from Host1 with telnet 192.168.100.1. Look at the running configuration: the password is in clear text.
  3. Enable service password-encryption. Look again: it is now type 7. Note that it is reversible.
  4. Replace the line password with local users: netadmin at level 15 and helpdesk at level 1, both with scrypt secrets. Use login local.
  5. Configure the domain name, a 2048-bit RSA key and SSH version 2. Restrict transport input to SSH and apply the MGMT-ONLY access-class. Repeat for every VTY range.
  6. Add login block-for 60 attempts 3 within 30 and login on-failure log.
  7. Test from Host1: ssh [email protected] succeeds and lands at R1#. ssh [email protected] lands at R1>. Telnet is refused.
  8. From the user PC, ssh -l netadmin 10.10.10.1 is refused by the access-class.
  9. From Host1, fail the password three times quickly. The next attempt is refused for 60 seconds, and R1 logs a quiet-mode message.

Expected verification:

R1# show login
     A login delay of 1 seconds is applied.
     No Quiet-Mode access list has been configured.
     All successful login is logged and generate SysLog message.
     All failed login is logged and generate SysLog message.

     Router enabled to watch for login Attacks.
     If more than 3 login failures occur in 30 seconds or less,
     logins will be disabled for 60 seconds.
...
R1# show access-lists MGMT-ONLY
Standard IP access list MGMT-ONLY
    10 permit 192.168.100.0, wildcard bits 0.0.0.255 (6 matches)

The exact wording of show login varies by release. What matters is that the block-for policy is active and failures are logged.

Break it: remove ip domain name, run crypto key zeroize rsa, and try SSH again. Then put both back. This is the most common reason SSH "just stops working" after a hostname or domain change.

Quick check

A router has service password-encryption and username ops password 7 0822455D0A16. Is the ops password protected?

No. Type 7 is reversible obfuscation and the plain text can be recovered in seconds. Replace it with username ops algorithm-type scrypt secret <pw>, which stores a type 9 one-way hash.

SSH to a new router fails. The router has a hostname, a local user and transport input ssh. show ip ssh says SSH is disabled. What is missing?

An RSA key pair, and usually the domain name needed to generate it with the default label. Configure ip domain name, then crypto key generate rsa modulus 2048.

What is the difference between access-class MGMT in under line vty 0 15 and ip access-group MGMT in on Gi1?

The access-class filters only sessions to the VTY lines, from any interface. The interface ACL filters every packet arriving on Gi1, including transit traffic and routing protocols, and does nothing for sessions that arrive on other interfaces.

References

  • Cisco IOS XE Security Configuration Guide: "Configuring Security with Passwords, Privilege Levels, and Login Usernames" and "Secure Shell Version 2 Support" (search on cisco.com for your release)
  • Cisco Guide to Harden Cisco IOS Devices (search "Cisco Guide to Harden Cisco IOS Devices" on cisco.com)
  • RFC 4253 (SSH transport layer), RFC 7914 (scrypt), RFC 8018 (PBKDF2)
  • Cisco Live On-Demand Library: search "device hardening" and "IOS XE security"