2

i am trying to configure the switch to have both telnet and ssh.
from what i understand the "login local" command will tell the switch to ask for the user name and password i've configured using

username {name} secret {password}

from what i've learned about vty if no password is configured in (config-line)# mode (in vty)
i will get an error

so my questions are:

  • will i get an error if i am using "login local" + username & secret without a configured vty password?
  • assuming i've set vty to "login local", i've given it a vty line password and i gave the switch a username & secret with " username {name} secret {password} " when i telnet will it ask me for the vty line password or the username & secret?

so basiclly the subject is "does the login local command in the vty lines set all (in telnet and ssh) login requirments to be the username & secret and if so do i need to give the vty line a password in order for it to work.

3 Answers 3

1
line vty 0 4
  login
  password vtypw

The login command tells the Router to authenticate all incoming virtual terminal sessions (telnet, ssh, etc) via the password set within line vty 0 4. In the case above, it means use vtypw.

username teddy password teddybear

line vty 0 4
  login local

The login local command tells the Router to authenticate all incoming virtual terminal sessions via the local username database -- aka, users created using the username XXX password YYY command.

Using login local skips the checking and validating against the VTY password set within line vty 0 4. Therefore, you do not need a password within line vty 0 4 if you have login local set.


will i get an error if i am using "login local" + username & secret without a configured vty password?

No, no errors. I just tested it in GNS3.

assuming i've set vty to "login local", i've given it a vty line password and i gave the switch a username & secret with " username {name} secret {password} " when i telnet will it ask me for the vty line password or the username & secret?

It will ask you for a username and expect the one from the local username database. Using the vty line password will not allow you access to the device.

2

Eddie's answer is 100% correct. I just want to add that you can also use this technique:

Router(config)# username teddy password teddybear    
Router(config)# aaa new-model
Router(config)# aaa authentication login default local
1
  • can you explain more about what exacty "aaa" means?
    – RedBelly
    Sep 23, 2016 at 13:10
0
  1. No. You can set only username without password. This means the password is empty string / characters. If login local is used, it will require a password during login. Just 'Press Enter' only and you will be granted access.

Router(config)#username Jon

  1. Regardless if 'vty access' set to SSH or/and Telnet, so long 'login local' is applied, it will ask for username and password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.