Console access to a Cisco IOS device does not have access protection set by default. To secure the access to the console of a device, you first need to configure it. By securing the console line, the device requests that the access credentials (password or username and password) be entered before any further commands.
Cisco IOS 裝置的主控台存取預設沒有存取保護。若要保護裝置主控台的存取安全，你必須先進行設定。透過保護主控台線路，裝置會要求在執行任何進一步命令之前，先輸入存取憑證（密碼，或使用者名稱與密碼）。
One way to secure console access is to use the line console 0command followed by the password and login subcommands to require the login and establish a login password on a console terminal. By default, no login is required on the console line.
保護主控台存取安全的一種方式，是使用 line console 0 命令，搭配 password 與 login 子命令，要求登入並在主控台終端機上建立登入密碼。預設情況下，主控台線路不需要登入。
Since the password is in plaintext, use theservice password-encryption command. Remember, the password is protected with the type-7 encryption, which is only an obfuscation and can be cracked in less than a second.
由於密碼是明文，請使用 service password-encryption 命令。請記住，此密碼受 Type 7 加密保護，這僅是一種混淆處理，不到一秒鐘就能被破解。
Configure console password:
設定主控台密碼：
Encrypt the cleartext password:
加密明文密碼：
Alternatively, you can use the username username password password command in the global configuration mode to create a user with the corresponding password. Next, use the line console 0 command followed by the login local subcommand to require the login on the console terminal. The local keyword indicates that the required credentials are in the local list of usernames and passwords. The next time that you connect to the console, a username and password will be required. In the configuration, the password is not encrypted. To encrypt the password, use the service password-encryption command, but, as mentioned, it uses a weak algorithm. For a higher security level, use the username username secret password command with Types 8 or 9.
或者，你可以在全域設定模式中使用 username username password password 命令來建立使用者及其對應的密碼。接著，使用 line console 0 命令，搭配 login local 子命令，要求在主控台終端機上登入。local 關鍵字表示所需的憑證位於本地使用者名稱與密碼清單中。下次連線至主控台時，將會要求輸入使用者名稱與密碼。在此設定中，密碼並未加密。若要加密密碼，可使用 service password-encryption 命令，但如前所述，它使用的是較弱的演算法。若需更高的安全等級，請搭配 Type 8 或 9 使用 username username secret password 命令。
The secret is entered in plaintext and by default is encrypted with the SHA256 algorithm, which is indicated by the number 8 before the ciphertext when displaying the username command configuration.
secret 是以明文輸入，並預設以 SHA256 演算法加密，這在顯示 username 命令設定時，會以密文前的數字 8 來表示。
You should carefully choose the type of the password to be used to protect the access to your router. To enter the privileged EXEC mode, you should use "enable password" or "enable secret", depending on the password type you require. Similarly, different encryption types are available for configuring a username. Types 8 and 9 are currently recommended. Here are some examples:
你應謹慎選擇用於保護路由器存取的密碼類型。若要進入特權執行模式，應根據所需的密碼類型使用「enable password」或「enable secret」。同樣地，設定使用者名稱時也有不同的加密類型可供選擇。目前建議使用 Type 8 與 9。以下是一些範例：
Password Type 密碼類型 | Command as entered 輸入的命令 | Password seen in device configuration 裝置設定中所顯示的密碼 |
Type 0 Type 0 | Router(config)# username sam password C1sco12345 Router(config)# username sam password C1sco12345 | username sam password 0 C1sco12345 username sam password 0 C1sco12345 |
Type 5 Type 5 | Router(config)# username john secret C1sco12345 or Router(config)# username john algorithm-type md5 secret C1sco12345 Router(config)# username john secret C1sco12345 or Router(config)# username john algorithm-type md5 secret C1sco12345 | username john secret 5 $12bhgddslgjrh username john secret 5 $12bhgddslgjrh |
Type 8 Type 8 | Router(config)# username jack algorithm-type sha256 secret C1sco12345 Router(config)# username jack algorithm-type sha256 secret C1sco12345 | username jack secret 8 $4.kMehFMHe4ew.chR48ui username jack secret 8 $4.kMehFMHe4ew.chR48ui |
Type 9 Type 9 | Router(config)# username ted algorithm-type scrypt secret C1sco12345 Router(config)# username ted algorithm-type scrypt secret C1sco12345 | username ted secret 9 /7$BpsgnGtdkTswkfjucj$.1b5a5.l username ted secret 9 /7$BpsgnGtdkTswkfjucj$.1b5a5.l |
The exec-timeout minutes [seconds] command prevents users from remaining connected to a line when the line is idle. In the example, when no user input is detected on the console for 5 minutes, the user that is connected to the console port is automatically disconnected. Using the exec-timeout 0 0 command disables the timeout. This should not be used in a production environment because it is not a secure practice.
exec-timeout minutes [seconds] 命令可防止使用者在線路閒置時持續保持連線。在此範例中，若主控台在 5 分鐘內未偵測到任何使用者輸入，連線至主控台連接埠的使用者將被自動中斷連線。使用 exec-timeout 0 0 命令會停用逾時功能。在生產環境中不應這麼做，因為這並非安全的做法。