Examkin

Question

Difficulty: HardDevice Access Control and Local Password Authentication

An infrastructure auditor reviews the local access credentials and line configuration snippet on an enterprise Cisco IOS switch:

text
username auditmgr privilege 15 secret 8 88 vG4k$9mP...
username techuser privilege 1 password 0 Cisco123!
service password-encryption
!
line console 0
login local
!
line vty 0 4
login local
transport input ssh
!
line vty 5 15
login
transport input ssh

Based on this configuration, which statement accurately describes the operational and security impact on administrative access?

  1. A
    VTY lines 5 through 15 will automatically fall back to local database authentication because transport input ssh is enforced across all VTY lines.
  2. B
    The auditmgr account uses Type 8 PBKDF2 hashing, which provides weaker protection than the reversible Type 7 cipher applied to techuser by service password-encryption.
  3. VTY lines 5 through 15 will fail local database authentication because they specify login instead of login local, while techuser credentials are protected only by weak Type 7 encryption.Answer
  4. D
    Executing service password-encryption elevates techuser to privilege level 15 and converts the unencrypted password string into a secure Type 9 scrypt hash.

Answer

VTY lines 5 through 15 will fail local database authentication because they specify 'login' instead of 'login local', and 'techuser' credentials are stored using weak reversible Type 7 encryption.
The statement identifying that VTY lines 5 through 15 will fail local database authentication due to using 'login' instead of 'login local', alongside identifying that 'techuser' relies on weak Type 7 encryption, is correct. On Cisco IOS lines, 'login' requires a line-specific password and ignores the local username database. Additionally, 'service password-encryption' only applies weak Type 7 reversible obfuscation to 'password' commands rather than strong 'secret' hashing (Type 5, 8, or 9).

Step-by-Step Solution

1
Analyze VTY line configuration for authentication mode consistency.
Lines 0-4 use 'login local' which queries the local database. Lines 5-15 use 'login' which expects a line password rather than checking local usernames, resulting in authentication failures for local database users accessing lines 5-15.
The 'login' command alone tells IOS to prompt for a line password set via 'password <str>' under the line context, whereas 'login local' instructs IOS to authenticate against configured 'username' database statements.
2
Evaluate local username password security types.
The 'auditmgr' account uses 'secret 8' (Type 8 PBKDF2 SHA-256 hash). The 'techuser' account uses 'password 0' which 'service password-encryption' transforms into a weak, easily reversible Type 7 cipher.
Type 7 encryption is weak Vigenère obfuscation meant only to prevent shoulder surfing. Type 8 (PBKDF2) and Type 9 (scrypt) secret hashes are cryptographically secure.
3
Combine line authentication behavior and password security analysis.
The configuration suffers from both line authentication misconfiguration on VTY 5-15 and weak credential protection for 'techuser'.
Combining these evaluations identifies the statement correctly detailing line authentication failure for local accounts on VTY 5-15 and weak Type 7 encryption.

Key Concept

Line Access Authentication and Cisco IOS Password Encryption Types
Rate this question

Topics

Device Access Control and Local Password Authentication

More questions from this topic