## Objective

Secure the control plane of your routers, switches and servers with sensible default policies.

## Basic router and switch configuration

### Turn Off the builtin Webserver

Contemporary Cisco devices have a builtin Webserver turned on by default. This is a hazard. We turn it off. Some versions have HTTPS enabled too. Turn that off as well.

    no ip http server
    no ip http secure-server

### Usernames and Passwords

MD5 and SHA1 are broken and should no longer be used.

Cisco defaults still use type 5 (MD5) encryption. Good choices are SHA256 (algorithm 8) and scrypt (algorithm 9). The latter has the benefit of being very slow (i.e. more robust against brute force attacks.

    ! Remember to change "X" to your campus number
    username campusX algorithm-type scrypt secret lab-PW
    !
    enable algorithm-type scrypt secret lab-EN
    !
    service password-encryption

Remember that for this workshop we use a shared password. Do not use this password in production under any circumstances. Do not use shared passwords.

## Host firewalls

Note: UFW by default will block external access to all ports on a host. If you are connected via SSH and enable UFW before allowing SSH access you’ll be disconnected. Enable SSH access before enabling the firewall.

### Get the status of UFW

    $ sudo ufw status

### Enable SSH access

    $ sudo ufw allow to any app OpenSSH

### Enable the host firewall

    $ sudo ufw enable

### Enable HTTP access

For the labs and demos later in this workshop, we need to be able to access the web services on your server.

    $ sudo ufw allow to any app "Apache Full" comment "HTTP/HTTPS"

An alternative way of spelling this is

    $ sudo ufw allow proto tcp from any to any port 80,443

## Device discovery

Our default Linux installation on your server does not include `lldpd`. You must install it and enable it first

    $ sudo apt install lldpd
    $ sudo systemctl enable lldpd

The out-of-the-box `lldpd` configuration reveals too much information. Edit the configuration and restart:

    $ sudo -e /etc/lldpd.conf
    $ sudo systemctl restart lldpd