After enabling this feature (through the auto secure command), the following global services are disabled on the router without prompting the user:

• Finger--Collects information about the system (reconnaissance) before an attack. If enabled, the information can leave your device vulnerable to attacks.

• PAD--Enables all packet assembler and disassembler (PAD) commands and connections between PAD devices and access servers. If enabled, it can leave your device vulnerable to attacks.

• Small Servers--Causes TCP and User Datagram Protocol (UDP) diagnostic port attacks: a sender transmits a volume of fake requests for UDP diagnostic services on the router, consuming all CPU resources.

• Bootp Server--Bootp is an insecure protocol that can be exploited for an attack.

• HTTP Server--Without secure-http or authentication embedded in the HTTP server with an associated ACL, the HTTP server is insecure and can be exploited for an attack. (If you must enable the HTTP server, you are prompted for the proper authentication or access list.)

Note	If you are using Cisco Configuration Professional (CCP), you must manually enable the HTTP server through the ip http server command.

• Identification Service--An insecure protocol, defined in RFC 1413, that allows one to query a TCP port for identification. An attacker can access private information about the user from the ID server.

• CDP--If a large number of Cisco Discovery Protocol (CDP) packets are sent to the router, the available memory of the router can be consumed, causing the router to crash.

Caution

NM applications that use CDP to discover network topology are not able to perform discovery.

• NTP--Without authentication or access-control, Network Time Protocol (NTP) is insecure and can be used by an attacker to send NTP packets to crash or overload the router. (If you want to turn on NTP, you must configure NTP authentication using Message Digest 5 (MD5) and the ntp access-group command. If NTP is enabled globally, disable it on all interfaces on which it is not needed.)

• Source Routing--Provided only for debugging purposes, so source routing should be disabled in all other cases. Otherwise, packets may slip away from some of the access control mechanisms that they should have gone through.

After enabling this feature, the following per interface services are disabled on the router without prompting the user:

• ICMP redirects--Disabled on all interfaces. Does not add a useful functionality to a correctly configured to network, but it could be used by attackers to exploit security holes.

• ICMP unreachables--Disabled on all interfaces. Internet Control Management Protocol (ICMP) unreachables are a known cause for some ICMP-based denial of service (DoS) attacks.

• ICMP mask reply messages--Disabled on all interfaces. ICMP mask reply messages can give an attacker the subnet mask for a particular subnetwork in the internetwork.

• Proxy-Arp--Disabled on all interfaces. Proxy-Arp requests are a known cause for DoS attacks because the available bandwidth and resources of the router can be consumed in an attempt to respond to the repeated requests that are sent by an attacker.

• Directed Broadcast--Disabled on all interfaces. Potential cause of SMURF attacks for DoS.

• Maintenance Operations Protocol (MOP) service--Disabled on all interfaces.

After AutoSecure is enabled, the following global services are enabled on the router without prompting the user:

• The service password-encryption command--Prevents passwords from being visible in the configuration.

• The service tcp-keepalives-in and service tcp-keepalives-out commands--Ensures that abnormally terminated TCP sessions are removed.

Caution

If your device is managed by an NM application, securing access to the router could turn off vital services and may disrupt the NM application support.

After enabling this feature, the following options in which to secure access to the router are available to the user:

• If a text banner does not exist, users are prompted to add a banner. This feature provides the following sample banner:

Authorized access only
This system is the property of ABC Enterprise
Disconnect IMMEDIATELY if you are not an authorized user!
Contact abc@xyz.com +99 876 543210 for help.

• The login and password (preferably a secret password, if supported) are configured on the console, AUX, vty, and tty lines. The transport input and transport outputcommandsare also configured on all of these lines. (Telnet and secure shell (SSH) are the only valid transport methods.) The exec-timeout command is configured on the console and AUX as 10.

• When the image on the device is a crypto image, AutoSecure enables SSH and secure copy (SCP) for access and file transfer to and from the router. The timeout seconds and authentication-retries integer options for the ip ssh command are configured to a minimum number. (Telnet and FTP are not affected by this operation and remain operational.)

• If the AutoSecure user specifies that their device does not use Simple Network Management Protocol (SNMP), one of the following functions occur:

  • In interactive mode, the user is asked whether to disable SNMP regardless of the values of the community strings, which act like passwords to regulate access to the agent on the router.
  • In non-interact mode, SNMP is disabled if the community string is “public” or “private.”

Note	After AutoSecure has been enabled, tools that use SNMP to monitor or configure a device is unable to communicate with the device through SNMP.

• If authentication, authorization, and accounting (AAA) is not configured, configure local AAA. AutoSecure prompts users to configure a local username and password on the router.

The following logging options are available after AutoSecure is enabled. These options identify security incidents and provide ways to respond to them.

• Sequence numbers and time stamps for all debug and log messages. This option is useful when auditing logging messages.

• Logging messages can be generated for login-related events; for example, the message “Blocking Period when Login Attack Detected” is displayed when a login attack is detected and the router enters “quiet mode.” (Quiet mode means that the router does not allow any login attempts through Telnet, HTTP, or SSH.)

For more information on login system messages, see the Cisco IOS Release 12.3(4)T feature module Cisco IOS Login Enhancements .

• The logging console criticalcommand, which sends system logging (syslog) messages to all available TTY lines and limits messages based on severity.

• The logging buffered command, which copies logging messages to an internal buffer and limits messages logged to the buffer based on severity.

• The logging trap debugging command, which allows all commands with a severity higher than debugging to be sent to the logging server.