Slashdot Mirror
8 Steps To Protect Your Cisco Router
Daniel B. Cid writes "I wrote the article '8 steps to Protect your Cisco router' (PDF). This small text gives to the reader eight steps (very easy to understand) showing how minimize your Cisco router exposure, by turning off some unused services, applying some access control lists and applying some security options available on that."
Too bad John Ritter died. He shall be missed.
This is such a retarded article. How did this make Slashdot? On a related note, check out my article, 1 step to securing Windows 2000. Block all ports.
Is this like "2 Step To Protect Your Windows Computer."
1. Turn it off.
2. Lock the room door.
SCO (noun.)- A Slimy Corporate Ogre. Often seeks free money.
This is a shameful excuse for a security document. It may be applicable to small offices with a single router, etc. but to post it here as a be all, end all Cisco security document makes me shudder.
Step 1 to securing a Cisco device or any host for that matter is making sure you're running an OS with no blatant security vulnerabilities.
Okay, that's enough about that.
"A clear conscience is usually the sign of a bad memory."
1) Don't rest your coffee on the router
2) Keep the cords and wires out of heavy traffic areas
3) Do not fold, spindle, or mutilate
4) Keep out of reach of children
5) Be kind, rewind
6) Do not remove tag under penalty of law
7) No step
8) Lavese las manos, es la ley
8 steps to greasing your anus for yoda doll insertion
1) defecate. preferably after eating senna, ex lax, prunes, cabbage and hot sauces.
2) wipe ass with witch hazel, soothes horrific burns
3) prime anus with anal ease.
4) slather richly a considerable amount of vaseline or other anal lubricants into your rectum at least until the bend and also take your yoda doll
or yoda soap on a rope and liberally apply it.
5) pucker your ballon knot several times actuating the sphincter muscle in order to work it in
6) slowly rest yourself onto your yoda figurine
7) make sure to have a mechanism by which to fish yodo out of your rectum, the soap on the rope is especially useful because that is built in.
8) gyrate gleefully in your computer chair while your fat sexless geek nerd loser fat shit self enjoys the prostate massage you'll be getting. Read
slashdot. Masturbate to anime. Email one of the editors hoping they will honor you with a reply. Join several more dating services - this time, you
dont check the (desired - speaks english) and (desired - literate). You figure you might get a chance then. Order some fucking crap from Think Geek.
Get Linux to boot on a Black And Decker Appliance. Wish you could afford a new computer. Argue that IDE is better than SCSI because you cant afford
SCSI. Make claims about how Linux rules. Compile a kernel on your 486SX. Claim to hate windows but use it for Everquest. Admire Ghyslain's courage
in making that wonder star wars movie. Officially convert to the Jedi religion. Talk about how cool Mega Tokyo is. Try and make sure you do your
regular 50 story submissions to Slashdot, all of which get rejected because people who arent fatter than CowboyNeal can't submit. Fondle shrimpy
penis while making a yoda voice and saying, feel the force, padawan, feeel the foooorce, hurgm. Yes. Yes. When 900 years you reach, a dick half
as big you will not have.
All in a days work with a yoda figurine rammed up your ass.
1.) Shut down the router ...
2.) Disconnect the power
3.) Remove all network cables
4.) Remove router from rack, replacing it with a cheap Linux box with some high-end network cards, a hardened kernel and a good iptables script.
5.) Return your Cisco router to original styrofoam packaging. Lock it away somewhere safe.
6.) Your Cisco router is now protected
7.)
8.) Profit!!
Damn straight. I had a Cisco PIX 506E and the thing was rediculously overpriced for what it offered. The manuals that accompany the device were nothing more than IOS command guides (the product guide on CD only vaguely helpful).
I became a much happier person when I moved to a linux machine with a nice shorewall iptables script.
There is one thing I have to say about the cisco 506E, it had a form factor that beats the hell out of a plain pc. I would have loved to run linux on it. It was very small/quiet/light/unobtrusive.
A small disclaimer: I know that with tons of Cisco training you can become a master of these Cisco PIX devices. However I will never forgive cisco for charging for 3DES encryption "upgrades".
A netgear FVS318 VPN firewall has twice the features as this unit for $150, although dont expect huge throughput when using 3DES or AES for vpn tunnels, for that app a 400mhz or greater linux firewall would probably do the trick. They also had buggy firmware in the past, but they seem to be working well with the 1.4 firmware. They have dyndns integration, 8 vpn tunnels, really awesome web based configuration, and a nice professional looking casing. Hooking two of these units together for a vpn is a snap.
The Ro Factor - Jeep/Linux Weblog
you must be an idiot that works in some cheesy place . you know that right?
e cu re/pix.shtml
by the way, idiot, the 3DES shit is FUCKING FREE,
and i quoth CCO:
http://www.cisco.com/kobayashi/sw-center/ciscos
"*FREE* Register for PIX 56-bit IPSEC Software Feature Key
*Free* Register for a 3DES/AES IPSec Software Feature Key "
does the STARS in front of and behind the FREE make something unclear?
you gave up on the PIX config because you suck i've gotten those things to do quite a bit more than lin-sux can do.
oh yeah, where is the option in linux to setup failover and shit like that?
Not exactly free, given possible requirements of a support contract login along with that pix.
the nsa(or nsac or whatever they're called) wrote a much better one, coming in at about 300 pages. can't find the url, but it's on their site...
access-list 111 deny ip 169.254.0.0 0.0.255.255 any
which is used for APIPA ("Automatic Private IP Addressing", the serverless "DHCP" thing) which a lot of people overlook. Also, while looking for that I spotted that you have the wrong subnet masks for 172.16.0.0 (it's a /12 not a /16) and 192.168.0.0 (it's a /16, not a /8), so you should have:
access-list 111 deny ip 172.16.0.0 0.15.255.255 any
access-list 111 deny ip 192.168.0.0 0.0.255.255 any
Couldn't see anything else obvious to suggest, but I've only scanned it so far.
UNIX? They're not even circumcised! Savages!
..unplug the piece of shit.
Since when does the 506E support failover?
Also, the lack of "free" for the DES upgrades came from the lack of a support contract, something which i had no control over (i didnt control the budgeting for this unit). And if they are free now, it wasnt free when we used it.
I did not give up on IOS, we used the cisco firwewall at that company until I left, although I did ask for another network admin's help to set it up.
I'd also like to see what you've gotten a 506E to do that linux cant do, i believe you are talking about more expensive gear Anonymous Coward.
The Ro Factor - Jeep/Linux Weblog
Just stuff a cheap p-box full of nics, load OpenBSD and you can do stuff you can't do with a Cisco box that costs 50 grand.
It's Christmas everyday with BitTorrent.