kcc, Best practice would be to setup an authentication server (TACACS/RADIUS) and point your gear to that for your AAA, then setup a failsafe userid for when the device can not talk to the authentication server you still have a backup account. Having an auth server is great because you can manage users in 1 place (much easier for long-term administration). In addition to managing the user accounts you can get accounting logs which will provide you tracking for what commands/config changes that user makes).
Also you should consider using level 5 encryption on your userids versus level 7. Level 5 password encryption uses an MD5 hash (stronger) whereas level 7 passwords can be easily broken. Example: username test secret mypassword Using the "secret" option versus "password" will cause it to use the stronger encryption (MD5). Another thing regarding best practices - your privilege level in your example is 15: > cisco6513(config)#username peter privilege 15 password 7 peterpassword Do you want that userid to have level 15 access immediately? You could skip specifying a privilege level and have an "enable secret" setup which would require the user to enter a second password (enable) before being granted FULL level 15 access. Having multiple levels of passwords is stronger security versus 1 password then full access (depends on your security needs really). Also regarding best practices you should setup a syslog server to start logging your devices to it. Makes it much easier to track/troubleshoot an issue (and be able to pull that data long term i.e., a year or so after the event happened...) -Rich On Fri, Oct 17, 2008 at 3:15 PM, kcc <[EMAIL PROTECTED]> wrote: > Thank you so much. Good learning for me > ls there any best practice tip also? > I heard some AAA model. but I don't know exactly > > Thank you > > > On Fri, Oct 17, 2008 at 2:30 PM, Stephen Kratzer <[EMAIL PROTECTED]> wrote: > > > On Friday 17 October 2008 13:28:35 kcc wrote: > > > > Hi all > > > > > > > > I am new in cisco > > > > > > > > 1/ Can I know what is this command issue? > > > > > > > > cisco6513(config)#username peter privilege 15 password 7 > peterpassword > > > > Invalid encrypted password: peterpassword > > > > This command is invalid because the string 'peterpassword' is plaintext. > > Change the 7 to 0. > > > > > > 2/ I want to learn about best practice when doing the cisco config? > > > > eg: > > > > I heard it is better to issue command "eg: shutdown xx sec" when > doing > > > > the remote configure critical routes > > > > it can avoid the lost connection. the router can reload the startup > > > > config even though loss the connection > > > > If you are making changes that could potentially cause loss of remote > > connectivity, and you do not have physical access to the box, it is best > > practice to issue 'reload in x' where x is the minutes until reload. You > > want > > to ensure that x is long enough to make and verify your changes but short > > enough not to cause extended downtime if you make a mistake. Five to ten > > minutes is usually good for us. And remember to issue 'reload cancel' if > > your > > changes are made successfully. > > > > > > Thank you for your help > > > > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
