3 ms·

Can anyone explain how something so basic as changing the default password is left out? Do enterprise routers, such as Cisco's, have web-based management interf

Can anyone explain how something so basic as changing the default password is left out? Do enterprise routers, such as Cisco's, have web-based management interfaces or must everything be provisioned either manually over SSH or via some other provisioning software?

kbenson 11y ago
Imagine this scenario: There's already an exploited router on the network. On noticing traffic that can be identified as as coming from a Cisco router that appears to be booting (or apprears to be factory fresh), it immediately sources an exploit attempt to that address using default Cisco router passwords. If your lab allows internet access, you would probably be exploited within seconds of booting for the first time. There are sophisticated ways to employ very unsophisticated exploits.
cnvogel 11y ago
So, I worked at an internet provider up to several years ago, and we were using quite a lot of Cisco routers. Maybe something has radically changed, but I'd be surprised. Please someone correct me if that's now totally different. A cisco router with a blank config will come up with all interfaces configured "shutdown" and with no passwords set. You access it via a serial port on the front, labeled "Console". It provides a command line almost, but not quite, entirely unlike a unix shell :-) where you enter commands (ping, show routing tables, ..) or configuration statements (config terminal // Interface FastEthernet 0/0 // ip address 10.1.1.1... // no shutdown). If the only thing you do is to give it an ip-adddress on an interface and enable it, it will have a passwordless login via telnet. Every ISP/network department not run by complete imbeciles will have a "standard config" regarding login and passwords: Ours back in the days was a TACACS server for running user authentication, setting access levels for particular users (and automated logins for configuration management) and logging of logins/executed commands. You can also configure access lists that logins are only allowed from specific IP addresses. Probably also have a hardcoded password as fallback when the authentication server isn't reachable, disable the console port for when your router isn't in a locked box, ...

kbenson 11y ago

Imagine this scenario: There's already an exploited router on the network. On noticing traffic that can be identified as as coming from a Cisco router that appears to be booting (or apprears to be factory fresh), it immediately sources an exploit attempt to that address using default Cisco router passwords. If your lab allows internet access, you would probably be exploited within seconds of booting for the first time. There are sophisticated ways to employ very unsophisticated exploits.

cnvogel 11y ago

So, I worked at an internet provider up to several years ago, and we were using quite a lot of Cisco routers. Maybe something has radically changed, but I'd be surprised. Please someone correct me if that's now totally different. A cisco router with a blank config will come up with all interfaces configured "shutdown" and with no passwords set. You access it via a serial port on the front, labeled "Console". It provides a command line almost, but not quite, entirely unlike a unix shell :-) where you enter commands (ping, show routing tables, ..) or configuration statements (config terminal // Interface FastEthernet 0/0 // ip address 10.1.1.1... // no shutdown). If the only thing you do is to give it an ip-adddress on an interface and enable it, it will have a passwordless login via telnet. Every ISP/network department not run by complete imbeciles will have a "standard config" regarding login and passwords: Ours back in the days was a TACACS server for running user authentication, setting access levels for particular users (and automated logins for configuration management) and logging of logins/executed commands. You can also configure access lists that logins are only allowed from specific IP addresses. Probably also have a hardcoded password as fallback when the authentication server isn't reachable, disable the console port for when your router isn't in a locked box, ...