It's good security practice to disable an used services on your network devices.
In other words if you have services enabled on network devices that you are not using That's a potential
vulnerability that hackers can leverage Cisco ship routers and switches with a default set of services
enabled which are considered to be appropriate for most network deployments.
However that may be different in some of your networks.
So you should disable unnecessary services as an example.
So discovery protocol those PDP is enabled by default on most Cisco devices.
So unless you require that disable it especially on internet facing interfaces by disabling unneeded
services you preserve resources on your network devices as well as reduce the attack area of your network
devices.
In other words there are fewer opportunities for hackers to hack.
In this example I've got two Cisco routers running with ingenius three which in turn are connected to
a hub which in turn is connected to a cloud which connects and 3 to my physical network.
So let's look at the services on Route 1 and route to see what we can learn about the network wrote
of one show control plane host open ports will show us which ports are active on the router.
So in other words in this example the router is listening for telnet sessions to TZP port 23 that's
a default config on Rotto one on router to have enabled various services show control plane host open
ports shows us that those routers listening on TZP port 23.
In other words telnet DNS has been enabled so its listing on TZP and UDP port 53 HTP has been enabled
and so has the DHP service.
If those services are not required you should disable them show SCDP neighbors shows us CTP information
so we can see as an example out of foster Ethernet.
0 1 there's a Cisco unified communications manager running within VM where there's a 30 750 switch there
are two IP phones as well as a router rather one connected.
Ethan 00 as well as rockety.
Now because of non Cisco devices used in the topology the router may actually be seeing itself with
CTP messages afforded by other switches in the topology Router one is available on Foster Ethan at 00
So firstly we could launch attacks on this router using various ports that are open here including port
80.
So as an example or telnet to router to on the side the address on port 80
and notice the connection has been opened I'll press control-C and you can see that the Cisco IOS server
has now closed the connection.
But the point is I could launch an attack on the router on port 80 port 23 is also open.
In other words telnet.
So is port 53.
Notice the connection is open but the has been closed.
I've also enabled a another port on the router so I can use the command telnet to the IP address question
mark and I can see a list of various port numbers including the character generation port 19.
This is not something you want to enable on a router.
What it's doing here is getting the router to generate characters which uses up the CPQ of the router.
And he had so not showing a lot of use.
But the point is by doing this we try to use up C-p cycles and that's not something you typically want
to enable on a router.
So I could as an example open up multiple sessions to that router and looed at shows session shows me
that I have three sessions open to the Rodda And on this round so we can look at the open ports and
notice port 19 is established three times on the serrata there are three character generation sessions
open to the Rodda at the moment.
If telnet was enabled on the router
this router could telnet to port 23 and log in.
That's actually a lot slower than it was previously show sessions.
Shows me that I'll have four sessions open to the Rodda
in the output we can see a telnet session is listening but we can also see a telnet session established
as well as the charging sessions that are established.
So as an example if I resume session 1 that's the character generation that's taking place on the first
session.
Once again from a security point of view you want to lock down or remove unneeded services.
There's no reason to have these services enabled on a router today.
So no service TCAP small servers and UDP small servers.
We want to disable those sessions a stool establish at the moment.
So what I'll do is disconnect all my sessions
those charging ports have been removed and now if we try and telnet back to the router using the charge
and port that connection is refused.
That's port 19.
Notice it's refused port 80 is still open
using the Cisco Iowas server.
So unless you want an HDP server enabled and generally you do not just do a search for the command to
show you.
So in the running config we've got the HGP server enabled but the secure HDD server is disabled.
In other words HECS is disabled and TDP is enabled.
You don't want that.
Once again HGP is clear text AGP is not secure.
So you typically want to turn it off.
It's recommended that you do not run the PDP service.
You may want to run the secure server or SSL server way cheaper of a
but generally unless there's a requirement you want to turn off the HGP service.
Now why is the Rodda running a DNS service.
There's no reason to do that before I disable that.
Notice the change.
Now when I try and telnet to port 80 the connection is refused.
Whereas previously that connection was opened.
So once again there's no real reason to run a DNS server in production on a router.
You need to have a very good reason for doing that.
It's going to turn off the DNS service that port is now removed and once again unless required disable
DHP.
So to show run you can see ADHD pull was created.
So I'm going to disable that.
And now when we look at the open ports we can see that only telnet is enabled.
Generally you don't want to use telnet.
You should be using S-sh because telnet is insecure and we can see that buddying a why shock capture
Telenet sends packets in clear text which is not good.
May be OK in an internal network but it's recommended that you use S-sh because I can simply capture
your password off the wire.
So the road is asking for the password.
And if we scroll down the pause would see I guess CEO.
And if we just look at that session.
So follow the TZP Stream we'll be able to see the password and make that a bit bigger.
So you can see the mistake I made and then the password actually entered when logging into the Rodda
is the Viti y password and here's the Enable password or secret password on the router.
All shown in clear text so telnet isn't an ideal way to manage networks because of the security risks.
Once again show control hyphen plane host open ports shows you which ports are open on the Rodda also
have a look at show run to see if any services have been enabled that shouldn't be enabled on your router.
So at the moment this looks better.
We're not seeing any strange services enabled.
The command service allows you to see various services that could be enabled on a Rodda TCAP small servers
allowed me to use the character generation on a router.
Make sure that that and this are disabled they are disabled by default these days but just be aware
that someone may have enabled various services on your router.
So again use the show control plane host open ports to check which ports are open on the Rodda or other
network device.