35
DarkStar User Guide
3: Software
www.xkl.com
localhost CONF#
line console
localhost CONF-LINE-CTY#
login
localhost CONF-LINE-CTY#
end
localhost#
write memory
Are you sure? [yes/no]
yes
localhost#
NOTE
If you set a single-login password for CTY or VTY access, it will remain in the configuration file, but
will not remain in effect. The single-login password is not required while user accounts are active.
However, if you then revert to single-login password again, gaining access will still require the single-
login password you originally assigned. If login local is set, only the username/password pairs may
be used at that time.
WARNING
!
If the customer (startup) flash becomes unreadable for any reason, the DarkStar system
enters recovery mode and reverts to factory settings, in which case Telnet access is
disabled and only the console can be used for diagnosis and repair.
3.2.10.3 Access Control Lists
ACLs (Access Control Lists) may be used to enhance security and mitigate opportunities for denial-of-service attacks. This
feature is particularly important if the DarkStar system is not on a private management network and/or remote Telnet/SSH
access is enabled.
Incoming router traffic is compared to ACL entries based on the order that the entries occur in the router. The router searches
for matches and denies traffic if no match is found. There is an implied denial for traffic that is not permitted. A single-entry
ACL with only one deny entry has the effect of denying all traffic. New statements are automatically added to the end of the
list. Therefore, it may be helpful to place frequently used entries at the top of the list.
IP ACLs use masks with IP addresses to specify permission or denial. Masks used to configure IP addresses begin with 255 and
place larger values on the left side. For example, a typical IP address such as 209.165.202.129 uses a mask of 255.255.255.224.
However, masks for IP ACLs are complemented, and in this case the mask would be 0.0.0.31. This usage is sometimes referred
to as an inverse or wildcard mask. When the value of the mask is broken down into binary, the results determine which address
bits are considered to process traffic. “0” indicates that the address bits must be considered (exact match); “1” indicates no
match and no consideration is made.
The following example illustrates how to enable an ACL and applies to connections on the VTY:
localhost>
enable
localhost#
configure
localhost CONF#
access-list 2 permit 10.0.0.0 0.255.255.255
localhost CONF#
access-list 2 deny 0 255.255.255.255
localhost CONF#
line vty
localhost CONF-LINE-VTY#
access-class 2 in
localhost CONF-LINE-VTY#
exit
