Examkin

Soru

Zorluk: Çok zorDevice Access Control and Local Password Authentication

A network security engineer is hardening a Cisco IOS router for remote administrative access. The running configuration contains the following entries:

text
username opsadmin privilege 15 secret 9 99 eG8H kQzP8vX...usernameopstechsecret5kQzP8vX... username opstech secret 5 1 mER7mER7 h8GzK2Pq...
username opsguest password 0 Cisco12345!
service password-encryption
!
line vty 0 4
exec-timeout 10 0
privilege level 5
login local
transport input ssh

Based on this configuration, which operational behavior will occur when users authenticate remotely via SSH?

  1. The account without an explicit privilege level enters privilege level 5 upon successful login because it inherits the line configuration, whereas the administrator account enters privilege level 15.Cevap
  2. B
    The account without an explicit privilege level is restricted to privilege level 1 because line privilege level settings are completely bypassed when local authentication is enabled.
  3. C
    The service password-encryption command automatically upgrades the cleartext user password to a Type 5 MD5 hash and re-encrypts the Type 9 secret into Type 7 format.
  4. D
    Authentication fails for the administrator account because Type 9 scrypt passwords require AAA server authentication and are unsupported in the Cisco IOS local user database.

Cevap

The user account without an explicit privilege level definition inherits privilege level 5 from the line VTY configuration upon login, while the administrator account with privilege 15 specified in its username command overrides the line setting and enters privilege level 15 directly.
In Cisco IOS, when VTY lines are configured with 'login local' and a baseline 'privilege level X', any local database account that authenticates without an explicit privilege level defined in its 'username' statement will inherit privilege level X from the line. Accounts configured with an explicit 'privilege Y' attribute in the local database override the line setting and enter privilege level Y immediately upon successful authentication.

Adım Adım Çözüm

1
Analyze local database user configuration attributes
The administrator user account specifies explicit privilege level 15. The secondary technical user account specifies no privilege attribute, defaulting to privilege level 1 in its user definition.
Explicit privilege settings tied to a username dictate the user's privilege level unless unassigned.
2
Evaluate line VTY privilege level interaction with local authentication
The line VTY range is configured with 'privilege level 5' and 'login local'.
When authenticating against the local database via VTY lines, Cisco IOS uses the line's configured privilege level as the default EXEC level for any authenticated user account that does not have an explicit privilege level assigned.
3
Determine session privilege outcomes for both accounts
The administrator account enters privilege level 15 (explicit user override). The secondary technical account enters privilege level 5 (inherited from VTY line).
User-specific privilege levels take precedence over line privilege settings, but line privilege settings override the default level 1 for unassigned local accounts.

Anahtar Kavram

Interaction between local database username privilege settings, line VTY privilege levels, and Cisco IOS password hashing types
Bu soruyu puanla

Konular

Device Access Control and Local Password Authentication

Bu konudan daha fazla soru