configure SSH on 3600 series router on GNS3

configure SSH on 3600 series router on GNS3

from global config mode

ip domain-name sourav.com

crypto key generate rsa

choose key modulus 1024 as anything less than that will not support ssh version 2,also naturally 1024 offers better security

username sourav password cisco

line vty 0 4

transport input ssh

login local 

privilege level 15

exit

ip ssh version 2

ip ssh authentication-retries 2

now you can see the version of the ssh configured on the router

by

do sh ip ssh

it should show

SSH Enabled - version 2.0

now try ssh from qemu host(linux microcore)

using the command 

ssh sourav@192.168.0.1(the ip will be different in your case)

Basic Cisco Switch Security

basic security measures


close unused ports with the shutdown command


prevent the port from trunking with the switchport mode access command


place the port in an unused vlan(dummy vlan)


to implement port security the port has to be access


(switchport mode access)


switchport port-security maximum 1


switchport port-security violation 


there are 3 options


protect 


restrict 


shutdown


the default mode is shutdown,it shuts the port down,transmits a message to the 


log indecating the action taken and drops the violating frames.The interface 


status will be err-disabled(error-disabled),it must be manually reopened


restrict drops the violating frames transmits a message to the log indecating 


the issue,but does not shut down the port.


protect simply drops the violating frames


to configure the port to shut down if a frame is recieved with any source Mac 


Address other than bb-bb-bb-bb-bb-bb,we would use the following config


int fa 0/1


switchport mode access


switchport port-security mac address bb-bb-bb-bb-bb-bb


or you can use the command 


switchport port-security mac-address sticky(the first mac address which was 


secure)


see the result in 


show port-security int fa 1/0


in case of violation the led on the port will be dark

Creating a basic VLAN in Cisco 3650

sh mac-address-table 

sh mac-address-table dynamic

sh mac-address-table aging-time(this is the time to forget dynamically learned 

addresses,by default it is 300 sec or 5 min)

aging-time 0 disables this

to create a basic vlan 

go to interface you want to put in a apecific vlan(by defaul it is on vlan1)

int fa 0/1

switchport access vlan 24(it will put this port and the connected device on 

this port on vlan 24)

switchport mode access

sh vlan

sh vlan brief

in GNS3 in a 3650 series router acting as a switch the command will be

sh vlan-switch

sh vlan-switch brief

User administration in Linux Part 2

changing file permissions

chmod has 2 formats

1.symbolic

chmod g+w filename

here the write permission to this file will be added to the group associated
with this file

chmod ug=rw filename

here all the other permission will be erased exept for the ug=rw permission


Binary number mode

chmod 754 filename
      ugo

u=user

g=group

o=other 

    
in binary the weights of the corresponding 3 places are

  _   _   _


  4   2   1


to change the user that is currently logged on

su sourav

su: switch user not super user

to make a folder with some files which can only be accessed by a particular
group

create a group 

groupadd -r IT

use some users to the group

usermod -G IT sourav



create a folder in sourav's home directory



mkdir data

see it's permission using

ls -l

by default it would be owned by user private group sourav

to the change the owner group to IT

chown sourav.IT data(need to be root foe that)

then type ls -l

the group ownership of data would be the group IT

another way of doing this

be root

type

newgrp IT

then create the directory
 mkdir database

then type ls -l

the group ownership of database will be IT

make a normal user an admin of a group(only root can do that) so that he can
add/delete any user from the group

gpasswd -A sourav IT

now sourav can add kunal to IT

gpasswd -a kunal IT

now sourav can delete someone from IT group

gpasswd -d kunal IT

verify it in /etc/group file

User administration in Linux

Add remove modify users


Only root can do that(need to login in root)


utilities such as useradd,userdel and usermod


(they are in usr/sbin)


default config files in


/etc/skel


useradd -D


by default the user will be


Group=100
Home=/home
Inactive=-1
Expire=
shell=/bin/bash
Skel=/etc/skel


after expiration the user account and the files will not be deleted


inactive period : after this amount of time after expiration everything about the user will be deleted


when creating an user 2 files are modified /etc/shadow and /etc/passwd


in the home directory the user's profile is created


in the user's home directory there are files such as


.bash_logout .bash_profile .bashrc .mozilla .emacs .zshrc


they are all user config files,they start with a (.)


in the /etc/skel directory you will find exactly same files


when creating an user the files from /etc/skel is copied in to the user's home directory


set the password of an user (for username lisa),only root can do that


passwd lisa


/etc/passwd stores info about user accounts


/etc/shadow stores the passwords in encrypted format


cat /etc/passwd


the last line would be
kennedy:x:507:507::/home/kennedy:/bin/bash


x is for password,it means password is showed in /etc/shadow file


first 507 is kennedy's userid


second 507 is kennedy's group id


however the default group id is 100,but red hat gives every user an user private group,here it's id is 507


:: -> this blank space is for an comment which is absent


to add the comment to a user


useradd -c " comment string" sourav(for user sourav)


/home/kennedy is the default home directory for kennedy


/bin/bash is the default shell for kennedy


to delete an user


the command is userdel


userdel -r kennedy


userdel -r will delete the user with it's home directory and all the files in it's home directory


also the /etc/passwd file entry for kennedy will also be deleted


usermod command can alter existing account features




usermod -c "sougata Kundu" sougata




to create multiple user's password at once


cat > password


useradd kuntal


useradd kunal


useradd kundu


ctrl + z




chpasswd < password


the passwords will be set


to see all the groups


cat /etc/group


here we will see entry such as


lisa:x:501:


the first field is the name of the group


the second field x shows the password is stored in a different file


for groups the passwords are saved in /etc/gshadow


501 is the group identification number


next will be users in the group(currentle there are none)


to add a group


to add a regular group instead of a user private group


groupadd -r experts


that will tell the system that we want this group to have a identification number under 500,over 500 numbers are reserved for user private groups


to add an user to this group


usermod -G experts lisa


we can verify in the /etc/group file that in the expert group(which has an id of 102 so it's not an user private group,now has lisa on this group)


let's add another group


groupadd -r adults


to add lisa in this group


if we use


usermod -G adults lisa


lisa will be in adults group but not in experts group anymore


to keep lisa in both groups


usermod -G experts,adulls lisa


to see if a particular user in which groups


the command is


groups lisa