Examkin

Question

Difficulty: HardDevice Access Control and Local Password Authentication

A network administrator configures a Cisco IOS switch for secure management access. The following excerpt is retrieved from the running configuration:

text
username secadmin privilege 15 secret 8 88 k9A$eP2xL1...
service password-encryption
!
line vty 0 4
transport input ssh
login

When a network engineer attempts to establish an SSH session using the `secadmin` account credentials, the authentication attempt is rejected. Which configuration change must be applied to line vty 0 4 to allow authentication using the local user database?

  1. Replace the `login` command with `login local` under line vty 0 4 configuration mode.Answer
  2. B
    Configure an `enable secret` password in global configuration mode to authorize the privilege 15 level.
  3. C
    Execute `no service password-encryption` globally to prevent decryption errors on Type 8 secret hashes.
  4. D
    Add `transport input ssh telnet` under line vty 0 4 to allow fallback negotiation during credential validation.

Answer

Replacing `login` with `login local` under line vty 0 4 configuration mode resolves the authentication failure by directing Cisco IOS to check credentials against accounts in the local running-config database.
The correct answer specifies changing `login` to `login local` on line vty 0 4. In Cisco IOS, the simple `login` command restricts authentication to a line password. If no line password is configured, access is refused. Executing `login local` forces Cisco IOS to authenticate incoming SSH connections against accounts defined in the global local database, such as `secadmin`.

Step-by-Step Solution

1
Analyze the VTY line authentication configuration.
The configuration shows `login` under `line vty 0 4` without a line-level `password` statement or the `local` keyword.
The bare `login` command expects a password defined directly on the line using `password <string>`. Without it, all login attempts are blocked.
2
Evaluate local database user configuration.
A local user `secadmin` is present with a valid Type 8 PBKDF2 secret hash (`secret 8 ...`).
Local credentials exist, but Cisco IOS must be instructed to consult the local account database for line access.
3
Identify the required CLI command fix.
Configuring `login local` under `line vty 0 4` binds incoming VTY authentication to the local username database.
This allows `secadmin` credentials to be validated successfully during SSH setup.

Key Concept

Cisco IOS Line VTY Local Database Authentication
Rate this question

Topics

Device Access Control and Local Password Authentication

More questions from this topic