Configure and collect evidence: Working Principle of Telnet Remote Management Protocol

Configure and collect evidence: Working Principle of Telnet Remote Management Protocol

Telnet is a member of the TCP/IP protocol family. It is a standard protocol and main implementation method for the Internet remote Logon Service. It uses port 23 of the TCP protocol to complete the work, providing users with the ability to complete the configuration of remote hosts, routers, switches and other network devices on the local computer. Cisco's IOS system integrates the Telnet function and uses the Telnet program on a local computer to connect to a remote device. The local terminal can enter commands in the Telnet program, these commands run on routers and vswitches. They give people the same feeling as entering them directly on the console of the network device. To start a Telnet session, you must enter the user name and password to log on to the network device. The Telnet remote Logon Service consists of the following processes, as shown in Figure 9.1.

650) this. width = 650; "src =" http://www.bkjia.com/uploads/allimg/131227/16123120B-0.png "title =" 1.png" alt = "084806522.png"/>

When you Telnet a vrotelnet, the first step is to complete the TCP three-way handshake from the source host to port 23 of the vro23. After the three-way handshake is complete, then, the Telnet password and command entered on the source host are transmitted to the vro and executed. When a Telnet command is sent to a vrotelnet, it does not undergo any encryption or security measures. In addition, if you enter a character on the keyboard, it will pass a character. Therefore, the security is not high. You can use the protocol analyzer to easily obtain commands entered by users through Telnet.

Demonstration: Telnet Remote Management for Cisco Routers

Demonstration objectives:Complete the Telnet configuration on the Cisco router and analyze the Telnet data frame.

Demo environment:The demo environment is shown in Figure 9.1.

Demo steps:

Step 1:To learn how to configure the Telnet service on the vrotelnet, you must first understand the line sequence of Telnet. You can use the show line command to view the serial numbers of various routes on the vro, as shown in Figure 9.2.

650) this. width = 650; "src =" http://www.bkjia.com/uploads/allimg/131227/1612315M2-1.png "title =" 2.png" alt = "084912277.png"/>

NCTY:Indicates the line of the Console.

NAUX:The line of the auxiliary control terminal.

NVTY:Dedicated Telnet lines, with a total of five lines counted from 2 ~ 6.

Note: "*" indicates that the line is being used. To configure Telnet, you must first enter the line number that belongs to Telnet. There are two ways to enter, one is to enter through the logical line sequence line vty 0 4, the other is to enter through the physical line sequence line 2 6, you can configure Telnet in either of the following ways:

650) this. width = 650; "src =" http://www.bkjia.com/uploads/allimg/131227/1612315U2-2.png "title =" 3.png" alt = "085008385.png"/>

Step 2:Start configuring the Telnet service on the vrotelnet. After entering the Telnet line mode, configure the Telnet command as follows. Then, you can run the Telnet command 192.168.1.1 at the command prompt CMD on the host at 192.168.1.1 to perform Telnet logon. The command to configure Telnet is as follows:

Router (config-line) # login * Indicates logon authentication for telnet.

Router (config-line) # password ccna * configure the logon password for telnet.

Router (config) # enable password ccna2 * configure the enable user password for the vro.

Step 3:Use the protocol analyzer to obtain data frames for Telnet. Enable the protocol analyzer before Telnet to the target vrotelnet r1194251.1 on the host at 192.168.1.2. Then, complete the Telnet logon. After the password is entered, stop the protocol analyzer, the data frame structure shown in Figure 9.3 is displayed. We can see the three TCP handshakes of Telnet and the input of each password. We can see that Telnet commands are transmitted one by one without any encryption protection.

650) this. width = 650; "src =" http://www.bkjia.com/uploads/allimg/131227/1612311617-3.png "title =" 4.png" alt = "085059410.png"/>

Note: through the demonstration of the above steps, we can draw a conclusion: as far as the Telnet service is concerned, its security is very fragile, because the login verification password has not been protected, it is easy to be stolen by illegal users. So how can we safely Replace the Telnet service?

This article is from the "unknown Christ" blog. For more information, contact the author!