Content

| 9.5 |  | Securing Remote Management |
| 9.5.2 |  | Advanced user name options |

There are a wide variety of user-specific options available for configuration in the Cisco IOS. - These commands can be used either singularly, or in combination to provide granular control over connections to the device. These options can be entered individually, or together in a single command.

> Note: These commands are stored in running config as a single command.

The first of these is the

username name secret password command. This command is used to store a user’s password using strong encryption, even if service password-encryption is not enabled.

> Note: The

username name secret password command is used as an alternative for the username name password password command.

Using the

username name nopassword command creates a user account that does not require a password to log on. This feature might be used for a generic account, and should only be implemented in conjunction with a limited privilege level associated with that username. Use of this feature in a production environment is not recommended.

The

username name privilege level command is used to limit the scope of commands available to a particular user. For example, the command username Alice privilege 1 gives Alice user-mode access after she authenticates with the server. The command username Bob privilege 15 gives Bob privileged-mode access after he authenticates with the server.

The

username name user-maxlinks number command is used to limit the maximum number of sessions a particular username can establish simultaneously. This can be used to control use of resources by users, giving different user accounts different levels of access to resources.

Access-lists can be bound to specific usernames using the

username name access-class access-list command. This forces session traffic from a specific user to match permit statements defined in an access-list in order to establish a successful connection.

For example, with these commands an administrator has a large degree of flexibility. For example, a guest login account can be created that requires no password, has user-mode access only, is limited to a maximum of two simultaneous sessions, and can only be used from a defined IP host or subnet on the network.

| Interactive Media Activity Checkbox: Username Options for Accessing Cisco Devices After completing this activity, the students will be able to understand username options for accessing Cisco devices.