Secure your Wireless Network

 

 Secure your Wireless Network :

 ________________________________________

Follow us on Facebook

Follow us on Google+

________________________________________

To secure your wireless network is an essential step to prevent a malicious user to use your wireless network. Here are the steps to follow.

Change the user password of your wireless router :

 

 Access the configuration utility of your router is secured with a username and a password. This page is accessed by typing the IP address of your router in your internet browser (eg 192.168.1.1). The first step in securing your new wireless network is to change the password by going to the option to change it.

Define your network name (SSID) :

Any WiFi network has a name: the SSID (Service Set IDentifier). The second step is to change the name and hide at the sight of malicious users. In the configuration utility of your router, change the default SSID name in avoiding it is too simple.Désactivez then broadcast SSID name of your wireless network by checking the corresponding box, so that n 'not appear in the list of possible connections of your neighbors.

Enable encryption on your network (security key) :

 

Before using your wireless network, it is useful to encrypt it with a digital key to not allow access only to users with it. Two types of data encryption currently exist: WEP (Wired Equivalent Privacy) and WPA (Wi-Fi Protected Access). If your router and your wireless adapters support it, you should opt for WPA encryption key with "pre-shared". However, if your hardware does not support WPA, then select WEP. The manipulation is simple because the digital encryption is created from a sentence you must enter a minimum 5-letter word or phrase in the text box and the router will generate different codes. Do not forget to note (one is enough) because they will be used to connect each computer on the network.

MAC address filtering :

Devices (PC or PDA) connected to a wireless network have a network card fitted with a specific address: MAC address (regardless of it, a computer is defined by its IP address). In the configuration utility of your router, you must activate the filter option and enter the MAC addresses of each of your devices. Thus, only these devices (known on the network by MAC address) can access the network.

Configure machines WiFi :

For each machine that can connect to the network, you need to specify the information listed above. After researching your wireless network, you must change the SSID to match the one you specified for the router. Then enter the numeric key encryption that was specified in the configuration utility of the router. This done, your device should connect to the router and the Internet.

Enable File Sharing :

To share files between computers and devices connected Wifi, you need to enable file sharing. The process of sharing in Windows XP is simple. Select << Control Panel >>, then << Network Connections >> and then click Create a home network or a corporate network. Then select This computer connects to the Internet through another computer on my home network or through a residential gateway. The connection wizard will detect your Internet connection.

To share a folder in Windows XP, right click on the file in question, and choose <<Sharing and Security>> and select the Share this folder option. To then access all shared folders from any machine on the network, click Start then My Network Places.

The technique is the same to a network printer: On the computer to which the printer is directly connected, go to the Start menu and then click Printers and Faxes, then right-click on the installed printer, and select Share.

 

Secure Access And Passwords

Secure Access And Passwords :

 

 ________________________________________

Follow us on Facebook

Follow us on Google+

________________________________________

 

Disable the reset passwords :

In some cases, it may be necessary to disable the service that allows you to reset the password on a router. It is important to note here that this deactivation can have serious consequences, for example, the obligation to return to the default configuration base (factory) router.

R1(config)# no service passwords-recovery

In case of loss of password, it will be impossible to reset the password of the super user. This command is part of the hidden commands Cisco IOS. I suggest you use it only if you do not have sufficient security level control physical access to your router. 

Set the minimum length of a password :

R1(config)# security passwords min-length 10

The router does not accept passwords less than 10 characters.

Limit the number of failed login attempts :

To prevent dictionary attacks and brute force passwords, limit the number of unsuccessful login attempts on your router (in our example, this number is 4).

R1(config)# security authentication failure rate 4 log

After four unsuccessful login attempts within one minute, the information will be recorded in the event log. 

R1(config)# login block-for 60 attempts 4 within 10

After four unsuccessful login attempts within an interval of 10 seconds, another attempt will be possible after 60 seconds, because the router will remain silent during this period.

During this period, it will be impossible to connect to the router. Which could affect administrators router with rights. To avoid this, it will create an ACL that allows administrators to log in during this period of silence (quiet-mode). 

R1(config)# ip access-list standard login-permit-adm
R1(config-std-nac)# permit 172.16.20.0 0.0.0.255
R1(config)# exit
R1(config)# login quiet-mode access-class login-permit-adm

Prevent logins on lines (auxiliary, and virtual) :

/ / Auxiliary Line :

R1(config)# line aux 0
R1(config-line)# no password
R1(config-line)# login
R1(config-line)# exit

/ / Virtual lines :

R1(config)# line vty 0 4
R1(config-line)# no password
R1(config-line)# login
R1(config-line)# exit 

Just allow remote access via SSH (and telnet is not secure) :

R1(config)# line vty 0 4
R1(config-line)# no transport input
R1(config-line)# transport input ssh
R1(config-line)# exit

Configuring additional security for the VTY lines, console and AUX :

R1(config)# line vty 0 4
R1(config-line)# exec-timeout 5
R1(config-line)# exit

R1(config)# line console 0
R1(config-line)# exec-timeout 5
R1(config-line)# exit

R1(config)# line aux 0
R1(config-line)# exec-timeout 5
R1(config-line)# exit

R1(config)# service tcp-keepalives-in

Configuring SSH Security :

R1(config)# hostname Ottawa                                  // definition of hostname)
Ottawa(config)# ip domain-name cisco.com          // definition of the domain name)
Ottawa(config)# crypto key generate rsa                // generation of asymmetric keys
Ottawa(config)# username emabo secret cisco123

Ottawa(config)# line vty 0 4
Ottawa(config-line)# transport input ssh            // authentication configuration local and VTY
Ottawa(config-line)# login local

Ottawa(config)# ip ssh time-out 10                        // configure ssh timeouts
Ottawa(config)# ip ssh authentication-retries 3    // configuration time test new ssh

Pay special attention to vulnerabilities SNMP, NTP and DNS :

To ensure functionality, a router relies on other services such as  service name resolution. It turns out that these services are often vulnerable. it should therefore ensure that the ancillary services relied on a router are properly configure and secure.

Disable all services, protocols and unnecessary accounts :

R1(config)# no service finger                            // example of the finger service
R1(config)# no cdp run                                       // example CDP