1

I have already referred to this similar question: Telnet or SSH into a Cisco router but the procedure did not work for me.

I have a Cisco 891W. I am able to log in via the console port just fine with username:password. I see a Telnet interface and get an interactive prompt there, but using the same username:password that is successful on console login fails. Likewise, attempting to access a web interface at the same IP with the same credentials fails.

Here is a portion of my show run to give an idea of what's been done.

enable secret 5 mysecret
enable password mypassword
!
aaa new-model
!
aaa authentication login default local
!
username myuser password 0 mypassword
username admin privilege 15 secret 5 mysecret
!
ip access-list standard access-internal-only
 permit 192.168.1.0 0.0.0.255
!
control-plane host
 management-interface FastEthernet0 allow https ssh snmp
line vty 0 4
 access-class access-internal-only in
 password mypassword
 transport input telnet ssh
line vty 5 15
1
  • 1
    Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 25 '18 at 8:16
4

Since you have

line vty 0 4
  password mypassword

you need to connect with "mypassword".

If you want to connect with the user "mysuser" you need to enter the command

line vty 0 15
   login local

Note that telnet is highly insecure, you should disable it and use only ssh, with transport input ssh

Also you shouldn't use

username myuser password 0 mypassword

but rather

username myuser secret 0 mypassword

with

service password encryption

so your password are encrypted in a secure way. The "password" encryption method is kept for compatibility purpose but it is not secure at all (you can find on line tool to decrypt such passwords).

3
  • With aaa new-model, the old line password doesn't apply. (hint: it asks for a username) His control-plane policy doesn't allow telnet.
    – Ricky
    Apr 18 '18 at 17:24
  • login local was invalid after line vty 0 15. A suggested alternative from the CLI was login authentication default. I do have the line aaa authentication login default local in my show run. Is login authentication default supposed to be a valid alternative? I tried it, it didn't work. Apr 19 '18 at 4:40
  • Looks like most of my problem is not understanding aaa. Not sure why it was enabled, so now I've disabled it. I was able to put in login local but that didn't solve my ability to authenticate over telnet. (I realize ssh is the better solution, I'm just trying to solve the auth issue then move to hardening) Apr 19 '18 at 4:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.