Cisco Systems 3550 Protecting Access to Privileged EXEC Commands

6-2
Catalyst 3550 Multilayer Switch Software Configuration Guide
78-11194-03
Chapter6 Administering the Switch
Protecting Access to Privileged EXEC Commands
To prevent unauthorized access into your switch, you should configure one or more of these security
features:
•At a minimum, you should configure passwords and privileges at each switch port . These passwords
are locally stored on the switch. When users attempt to access the switch through a po rt or line, they
must enter the password specified for the port or line before they can access the switch. For more
information, see the “Protecting Access to Privileged EXEC Commands” section on page 6-2.
•For an additional layer of security, you can also configure username and password pairs, which are
locally stored on the switch. These pairs are assigned to lines or interfaces and authenticate each
user before that user can access the switch. If you have defined privilege levels, you can also assign
a specific privilege level (with associated rights and privileges) to each username and password pair.
For more information, see the “Configuring Username and Password Pairs” section on page 6-7.
•If you want to use username and password pairs, but you want to store them centrally on a server
instead of locally, you can store them in a database on a sec urity server. Multiple networking devices
can then use the same database to obtain user authentic atio n ( and , if n ece ssary, authorizatio n)
information. For more information, see the “Controlling Switch Access with TACACS+” section on
page 6-10.
Protecting Access to Privileged EXEC Commands
A simple way of providing terminal access control in your network is to use passwords and assign
privilege levels. Password protection restricts access to a network or network device. Privileg e levels
define what commands users can issue after they have logged into a network device.
Note For complete syntax and usage information for the commands used in this section, refer to the Cisco
IOS Security Command Reference for Release 12.1.
This section describes how to control access to the configuration file and privileged EXEC commands.
It contains this configuration information:
•Default Password and Privilege Level Configuration, page 6-3
•Setting or Changing a Static Enable Password, page 6-3
•Protecting Enable and Enable Secret Passwords with Encryption , p ag e 6- 4
•Setting a Telnet Password for a Terminal Line, page 6-6
•Configuring Username and Password Pairs, page 6-7
•Configuring Multiple Privilege Levels, page 6-8