Default uname and pass: pix/cisco

eth0 - outside (ssh access only)

eth1 - inside (telnet access)

hostname [put some name] (required for ssh on outside iface)

domain-name [put some domain name] (required for ssh on outside iface)

ca generate rsa key 1024 (or 512 or 2048, etc.)

ca save all

ssh [put your ip] [put your subnet mask] outside

ssh timeout [number] (default is 5 = 5min.)

show ssh sessions

PRIVILEGE LEVELS:

• privilege level 0 — Includes the disable, enable, exit, help, and logout commands
• privilege level 1 — Normal level on Telnet; includes all user-level commands at the pix> prompt
• privilege level 15 — Includes all enable-level commands at the pix# prompt

#username [username] password[password] privlege[privilege level e.g. 15] (cerating user - privilege can be separate, privilege manipulation is allowed)

#no username[username] (removing user)

#enable password [type your password to enable mode]

************************************************************************************************************

When there are no AAA commands implemented into routers, there must be a login and enable password set to have the PIX or ASA remotely accessible via telnet. Using more secure remote access method such as ssh is sometimes preferable or even required. Unlike routers that have no requirement of AAA implementation for ssh accessible, PIX or ASA requires such proper AAA implementation. With proper AAA command set implementation, all access attempt via telnet, ssh, http, https, SNMP, console in via Console port will be authenticated using the same credential.

Similar to router, PIX or ASA can use either local credential or remote credential stored on external AAA server such as TACACS+ and RADIUS. Using such external servers for authentication are highly recommended to provide more secure approach. Check out the following FAQ for more info on TACACS and RADIUS.

»Cisco Forum FAQ »Secure and Monitor Network Access with AAA (TACACS/RADIUS) and Privilege Level

These AAA command set has been tested in various situation; including automatic failover from TACACS+ server to local credential or local enable password during unreachable TACACS+ server situation due to down server or down network.

At first AAA command set to authenticate using local credential only is introduced to provide preliminary understanding. Then external TACACS+ server utilization is introduced to provide greater security perimeter.

PIX Firewall running OS version 6.3

1. Using Local Credential

Sample #1:

username [ENTER USERNAME HERE] password [ENTER ADMIN PASSWORD HERE] privilege 15
enable password [ENTER ENABLE MODE PASSWORD HERE]
aaa-server LOCAL protocol local
aaa authentication http console LOCAL
aaa authentication telnet console LOCAL
aaa authentication ssh console LOCAL

Behavior Description

With this AAA command set, there will be dedicated password for each username. There will be however single enable password that all usernames share to log into enable mode.

In other words, password for username and password for enable mode are in general different. When there is only single username defined, password for username and password for enable mode could be set as the same. With either case, this approach is considered insecure since the idea of having "shared password" as the only enable password is unreliable.

To login, enter the local username and password. To enter the privilege mode, enter the enable password.

Sample #2:

username [ENTER USERNAME HERE] password [ENTER ADMIN PASSWORD HERE] privilege 15
enable password [ENTER ENABLE MODE PASSWORD HERE]
aaa-server LOCAL protocol local
aaa authentication http console LOCAL
aaa authentication telnet console LOCAL
aaa authentication ssh console LOCAL
aaa authentication enable console LOCAL
aaa authorization command LOCAL

Behavior Description

Similar to previous AAA command set, there will be dedicated password for each username with this AAA command set. You may note that there will be single enable password that all usernames could at one time share to log into enable mode.

By default, the shared enable password is not used. Each username has to use its own password to log into enable mode. If for some reason all of defined username is removed along with the password, then you may use the shared enable password to log into enable mode. However this condition may never occur since both username and shared enable password are defined locally. Compared to previous sample configuration, this approach is more secure since the shared password in reality may never be used at anytime.

With those in mind, note that in general password to login and to enter privilege mode is the same. Therefore you may never use the enable password to enter the privilege mode.

2. Using External TACACS+ Server

Sample #3:

username [ENTER USERNAME HERE] password [ENTER ADMIN PASSWORD HERE] privilege 15
enable password [ENTER ENABLE MODE PASSWORD HERE]
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server TACACS+ (inside) host [ENTER TACACS+ SERVER IP ADDRESS HERE] [ENTER SECRET KEY HERE] timeout 10
aaa-server LOCAL protocol local
aaa authentication http console TACACS+ LOCAL
aaa authentication telnet console TACACS+ LOCAL
aaa authentication ssh console TACACS+ LOCAL
aaa authentication enable console TACACS+ LOCAL
aaa authorization command TACACS+ LOCAL

Behavior Description

Similar to previous AAA command set, there will be dedicated password for each username with this AAA command set. By default, the ASA/PIX Firewall uses whatever password the username has as defined in the TACACS+ server database. If for some reason the TACACS+ server is unreachable or unusable, the ASA/PIX Firewall uses local credential (local username and associated password) to authenticate users.

You may note that with this sample configuration, the TACACS+ server is located toward Inside interface from the ASA/PIX Firewall perspective. There can be maximum of three attempts to log into the ASA/PIX Firewall using correct username and password. When user is not entering username or password within ten seconds, the login session will be timed out.

This approach should be considered most secure compared to the previous two sample configurations since a centralized authentication system (in this case the TACACS+) is in place and is used as primary resource while the local authentication is just for backup.

Well - seems like an easy task - just script: pubprn.vbs