30 · Implementing Device Hardening實作裝置強化

Disabling Unused Services停用未使用的服務

To facilitate deployment, Cisco routers and switches start with a list of services that are turned on and that are considered to be appropriate for most network environments. However, because not all networks have the same requirements, some of these services may not be needed. Disabling the unnecessary services has two benefits: It helps preserve system resources, and it eliminates the potential for security exploits on the unneeded services.

為了方便部署，Cisco 路由器與交換器出廠時預設啟用一系列服務，這些服務被認為適用於大多數網路環境。然而，由於並非所有網路都有相同的需求，部分服務可能並非必要。停用不必要的服務有兩個好處：有助於節省系統資源，並消除這些不需要之服務可能遭利用的安全漏洞。

To display the list of UDP or TCP ports that the device is listening on and to determine which services need to be disabled, use the show control-plane host open-ports command.

若要顯示裝置正在監聽的 UDP 或 TCP 連接埠清單，並判斷哪些服務需要停用，請使用 show control-plane host open-ports 指令。

Router# show control-plane host open-ports
Active internet connections (servers and established)
Prot   Local Address   Foreign Address          Service    State
 tcp            *:22               *:0       SSH-Server   LISTEN 
 tcp            *:23               *:0           Telnet   LISTEN 
 udp            *:49  172.26.150.206:0   TACACS service   LISTEN 
 udp            *:67               *:0    DHCPD Receive   LISTEN

In the example, services that are enabled on the router are SSH, Telnet, TACACS, and DHCP.

在此範例中，路由器上啟用的服務有 SSH、Telnet、TACACS 與 DHCP。

Along with services at a higher level of the TCP/IP stack, lower-layer services should also be considered.

除了 TCP/IP 堆疊較高層級的服務外，較低層的服務也應加以考量。

Cisco Discovery Protocol can be useful for network troubleshooting. Cisco Discovery Protocol is enabled by default in Cisco IOS Software Release 15.0 and later. Some network management software takes advantage of Cisco Discovery Protocol neighbor data to map out topological connectivity. Cisco VoIP deployments can take advantage of Cisco Discovery Protocol to automatically assign the voice VLAN to Cisco IP phones. On the other hand, Cisco Discovery Protocol provides an easy reconnaissance vector to any attacker with an Ethernet connection. For example, when a switch sends a Cisco Discovery Protocol announcement out of a port where a workstation is connected, the workstation normally ignores it. However, with a simple tool such as Wireshark, an attacker can capture and analyze the Cisco Discovery Protocol announcement. Included in the Cisco Discovery Protocol data is the model number and operating system version of the switch. An attacker can then use this information to look up published vulnerabilities that are associated with that operating system version and potentially follow up with an exploit of the vulnerability. The organization must decide whether the convenience that Cisco Discovery Protocol brings is greater than the security risk that comes with Cisco Discovery Protocol.

Cisco Discovery Protocol 對網路疑難排解相當有用。自 Cisco IOS 軟體 15.0 版及之後版本起，Cisco Discovery Protocol 預設為啟用。部分網路管理軟體會利用 Cisco Discovery Protocol 的鄰居資料來繪製拓樸連線圖。Cisco VoIP 部署可利用 Cisco Discovery Protocol 自動將語音 VLAN 指派給 Cisco IP 電話。然而，Cisco Discovery Protocol 也為任何具有乙太網路連線的攻擊者提供了一個容易利用的偵察管道。舉例來說，當交換器透過連接工作站的連接埠送出 Cisco Discovery Protocol 通告時，該工作站通常會忽略它。但只要使用像 Wireshark 這樣的簡單工具，攻擊者就能擷取並分析該 Cisco Discovery Protocol 通告。Cisco Discovery Protocol 資料中包含該交換器的型號與作業系統版本。攻擊者接著可利用這些資訊查詢與該作業系統版本相關的已知弱點，並可能進一步發動漏洞利用攻擊。組織必須自行評估 Cisco Discovery Protocol 帶來的便利性，是否高於其所伴隨的安全風險。

Depending on what service you will disable, where you enter the commands will differ. Some services are disabled in the global configuration mode. Other services are disabled in interface configuration mode. Some services have both options available. For example, you may choose to disable CDP as a service globally by using the no cdp run command in global configuration mode. This disables the service on all ports of the device. However, it is possible to disable the CDP service on a specific interface by using the no cdp enable command in interface configuration mode. Use interface configuration mode when CDP needs to be enabled or disabled on only specific interfaces.

依據你要停用的服務不同，輸入指令的位置也會有所不同。有些服務在全域設定模式下停用，有些服務則在介面設定模式下停用，也有些服務兩種方式皆可使用。例如，你可以選擇在全域設定模式下使用 no cdp run 指令，將 CDP 整體停用，這會在裝置的所有連接埠上停用此服務。然而，你也可以在介面設定模式下使用 no cdp enable 指令，只在特定介面上停用 CDP 服務。當只需要在特定介面上啟用或停用 CDP 時，請使用介面設定模式。

While there are recommendations for which services to disable on your network device, which services you choose to disable will differ based on the type of network device. Devices operating at Layer 2 and Layer 3 will require different services to be available. For example, you may not need CDP on a router and opt to disable it, whereas on a Layer 2 switch, you may need it to detect connected IP Phones.

雖然有一些關於應在網路裝置上停用哪些服務的建議，但實際上要停用哪些服務會依網路裝置類型而異。在第 2 層與第 3 層運作的裝置，所需啟用的服務也不同。例如，路由器上可能不需要 CDP，因此可以選擇停用，而在第 2 層交換器上，你可能需要它來偵測已連接的 IP 電話。

Here are some general best practices for services to be disabled if they are not needed:

以下是一些關於若不需要時應停用哪些服務的一般最佳實務建議：

  • Although the HTTP service enables convenient browser-based access to a Cisco device, it is strongly recommended that you turn off the HTTP service that is running. HTTPS can stay on.雖然 HTTP 服務可讓使用者以瀏覽器方便地存取 Cisco 裝置，但強烈建議關閉正在執行的 HTTP 服務。HTTPS 則可以保留開啟。
    • Use the no ip http server global configuration command to disable HTTP service. To re-enable the HTTP service after disabling it, use the ip http server command in global configuration mode.使用全域設定指令 no ip http server 停用 HTTP 服務。若要在停用後重新啟用 HTTP 服務，請在全域設定模式下使用 ip http server 指令。
  • You should enable Cisco Discovery Protocol on selected ports only, where the service does not represent a risk. Examples of interfaces that are at risk include external interfaces, such as those at the internet edge, and data-only ports at the campus and branch access.你應僅在不構成風險的特定連接埠上啟用 Cisco Discovery Protocol。有風險的介面範例包括外部介面，例如位於網際網路邊界的介面，以及校園與分公司接取層的純資料連接埠。
    • Use the no cdp enable command in interface configuration mode to disable Cisco Discovery Protocol on an interface. To disable Cisco Discovery Protocol on all interfaces, use the no cdp run command in global configuration mode. You can use the cdp enable and cdp run commands to re-enable Cisco Discovery Protocol as needed.在介面設定模式下使用 no cdp enable 指令，在特定介面上停用 Cisco Discovery Protocol。若要在所有介面上停用 Cisco Discovery Protocol，請在全域設定模式下使用 no cdp run 指令。你可以使用 cdp enable 與 cdp run 指令視需要重新啟用 Cisco Discovery Protocol。
  • Disable the finger service. The finger service allows users in the network to get a list of users currently using a routing device. The information provided in this command includes the processes running on the system, line number, connection name, idle time, and terminal location.停用 finger 服務。finger 服務讓網路中的使用者能取得目前正在使用某台路由裝置之使用者的清單。此指令所提供的資訊包括系統上執行中的處理程序、線路編號、連線名稱、閒置時間，以及終端機位置。
    • Use the no ip fingercommand in global configuration mode to disable the finger service.在全域設定模式下使用 no ip finger指令停用 finger 服務。
  • Disable the Bootstrap Protocol Service (BOOTP) if not needed.若不需要，請停用開機協定服務（BOOTP）。
    • Use the ip dhcp bootp ignore command in global configuration mode to disable the BOOTP service. However, this leaves the DHCP service enabled on the device.在全域設定模式下使用 ip dhcp bootp ignore 指令停用 BOOTP 服務。然而，這樣做會使裝置上的 DHCP 服務保持啟用。
  • Disable the Maintenance Operations Protocol (MOP) service. This service is part of the Decnet protocol suite. This allows access to nodes that are in a state in which only data link layer services are available.停用維護作業協定（MOP）服務。此服務是 Decnet 協定套組的一部分，允許存取僅有資料鏈結層服務可用之狀態下的節點。
    • Use the no mop enabled command in interface configuration mode to disable the MOP Service.在介面設定模式下使用 no mop enabled 指令停用 MOP 服務。
  • You should disable DNS resolution service. This service allows for the network device to make DNS lookup requests to a DNS.你應停用 DNS 解析服務。此服務允許網路裝置向 DNS 發出 DNS 查詢請求。
    • Use the no ip domain-lookup command in global configuration mode to disable the DNS resolution service.在全域設定模式下使用 no ip domain-lookup 指令停用 DNS 解析服務。
  • You should disable Packet Assembler/Disassembler (PAD) service, which is used for X.25 networks.你應停用封包組譯／拆解（PAD）服務，此服務用於 X.25 網路。
    • Use the no service pad command in global configuration mode to disable the PAD service.在全域設定模式下使用 no service pad 指令停用 PAD 服務。
  • Cisco IOS devices may retrieve their configuration from the network during startup. You should disable this service if it is not needed.Cisco IOS 裝置在開機期間可能會從網路擷取其設定。若不需要此服務，應加以停用。
    • Use the no service config command in global configuration mode. This command prevents the device from attempting to locate a configuration file on the network using TFTP.在全域設定模式下使用 no service config 指令。此指令可防止裝置嘗試透過 TFTP 在網路上尋找設定檔。
  • You should disable ICMP redirect messages on routers. When a router receives and transmits a packet on the same interface, it will send an ICMP redirect message back to the source. In a properly functioning IP network, a router will only send an ICMP redirect message to its own local subnets.你應在路由器上停用 ICMP 重新導向訊息。當路由器在同一介面上接收並轉送一個封包時，會向來源送回一則 ICMP 重新導向訊息。在正常運作的 IP 網路中，路由器只會向其自身的本地子網路發送 ICMP 重新導向訊息。
    • Use the no ip redirects command in interface configuration mode to prevent the router from sending ICMP redirects. A malicious user can exploit the ability of the router to send ICMP redirects by continually sending packets to the router. This forces the router to respond with ICMP redirect messages, which impacts the CPU and performance of the router.在介面設定模式下使用 no ip redirects 指令，防止路由器發送 ICMP 重新導向訊息。惡意使用者可能利用路由器發送 ICMP 重新導向訊息的能力，持續向路由器發送封包，迫使路由器不斷回應 ICMP 重新導向訊息，進而影響路由器的 CPU 與效能。
  • Proxy ARP is a technique in which one device will answer an ARP request that is sent to another device. There are several disadvantages for using proxy ARP. An example is that it leads to an increase in the amount of ARP traffic, causing resource exhaustion. An attacker may utilize this to exhaust the device’s resources.代理 ARP 是一種技術，指某一裝置代替另一裝置回應送往該裝置的 ARP 請求。使用代理 ARP 有若干缺點，例如會導致 ARP 流量增加，造成資源耗盡。攻擊者可能利用此特性來耗盡裝置的資源。
    • Use the no ip proxy-arp command in interface configuration mode to prevent the router from proxying ARP replies.在介面設定模式下使用 no ip proxy-arp 指令，防止路由器代理回覆 ARP。
  • When traffic is filtered by using an interface access-list, this triggers the router to send an ICMP unreachable message back to the source. While the generation of these messages are limited to one packet every 500 milliseconds, they increase the CPU utilization on the network device.當流量透過介面存取清單被過濾時，會觸發路由器向來源發送 ICMP 無法送達訊息。雖然這類訊息的產生頻率被限制為每 500 毫秒一個封包，但仍會提高網路裝置的 CPU 使用率。
    • Use the no ip unreachable command in interface configuration mode to prevent the router from sending ICMP unreachable messages. If ICMP Unreachable messages are required on the device, you may change the default rate limit by using the ip icmp rate-limit unreachableinterval-in-ms global configuration command.在介面設定模式下使用 no ip unreachable 指令，防止路由器發送 ICMP 無法送達訊息。若裝置上需要 ICMP 無法送達訊息，你可以使用全域設定指令 ip icmp rate-limit unreachableinterval-in-ms 變更預設的速率限制。
  • IP Directed Broadcasts allow devices to send an IP Broadcast packet to a remote IP subnet. When it reaches the remote network, the forwarding IP device will send it as a Layer 2 broadcast. This service can be used in amplification attacks and smurf attacks.IP 定向廣播允許裝置將 IP 廣播封包發送到遠端 IP 子網路。當封包到達遠端網路時，負責轉送的 IP 裝置會將其以第 2 層廣播方式發送。此服務可能被用於放大攻擊與 smurf 攻擊。
    • Current IOS software have this service disabled by default. You can enable it by using the ip directed-broadcast interface configuration command or disable it by using the no ip directed-broadcast command.現行 IOS 軟體預設停用此服務。你可以使用 ip directed-broadcast 介面設定指令啟用它，或使用 no ip directed-broadcast 指令停用它。
  • IP Mask Reply is used by a network device to respond to an ICMP Mask Request Message. This message will send the subnet mask of the interface as a response. This can allow an attacker to retrieve information about the network.IP 遮罩回覆用於網路裝置回應 ICMP 遮罩請求訊息。此訊息會將該介面的子網路遮罩作為回覆內容發送。這可能讓攻擊者取得網路相關資訊。
    • IP mask-reply is disabled by default on current IOS software. To enable IP Mask Reply on an interface, use the ip mask-reply command in interface configuration mode. To disable it, use the no ip-mask reply command.現行 IOS 軟體預設停用 IP mask-reply。若要在介面上啟用 IP 遮罩回覆，請使用介面設定指令 ip mask-reply。若要停用，請使用 no ip-mask reply 指令。
  • IP Gratuitous ARP messages are sent when the device updates its MAC Address-to-IP Address mapping. When this occurs, it will send a gratuitous ARP which is broadcast in the local segment.當裝置更新其 MAC 位址與 IP 位址的對應關係時，會發送 IP 免費 ARP 訊息。此時，裝置會在本地區段以廣播方式發送一則免費 ARP。
    • Use the no ip gratuitous-arps command in interface configuration mode to prevent the router from sending Gratuitous ARP messages on PPP links. This will not affect HSRP and VRRP protocols running on the device.在介面設定模式下使用 no ip gratuitous-arps 指令，防止路由器在 PPP 鏈路上發送免費 ARP 訊息。此設定不會影響裝置上執行的 HSRP 與 VRRP 協定。
  • IP Source Routing allows the router to decide on the forwarding path based on the source of the traffic. This can be used by attackers to attempt to route traffic around security devices in the network.IP 來源路由允許路由器依據流量的來源決定轉送路徑。攻擊者可能利用此特性，嘗試讓流量繞過網路中的安全裝置。
    • Use the no ip source-route command in the global configuration mode to disable IP source routing.在全域設定模式下使用 no ip source-route 指令，停用 IP 來源路由。
Which service or services that are enabled by default should be disabled on Cisco routers?在 Cisco 路由器上，哪些預設啟用的服務應該被停用？