🔐 Security+ Lab 5.10.5 — Restrict Telnet and SSH Access
🔐 Security+ Lab 5.10.5 — Restrict Telnet and SSH Access
This lab demonstrates how to disable insecure remote management (Telnet) and restrict secure remote access (SSH) to trusted administrators only, reducing the attack surface and protecting the network device management plane.
🧠 Key Concepts
Telnet vs SSH:
Telnet transmits credentials and data in plaintext → insecure.
SSH provides encrypted remote access and strong authentication.
Why Restrict Access?
Prevent credential theft and man-in-the-middle attacks
Limit management access to authorized users, IPs, and networks
Enforce least privilege and defense in depth
Security+ Exam Tip:
Always disable Telnet, use SSH v2 only, and restrict access via ACLs, RBAC, and AAA.
▶️ Step 1 — Identify Current Remote Access Methods
Review device configuration to determine if Telnet or SSH is enabled.
Identify management interfaces (console, management VLAN, LAN).
▶️ Step 2 — Disable Telnet
Turn off Telnet service completely.
Verify no ports (TCP 23) are listening.
✔ Telnet should never be enabled in production networks.
▶️ Step 3 — Enable and Harden SSH
Enable SSH v2 only.
Disable SSH v1 (if present).
Configure strong cryptography:
Key exchange: modern algorithms
Encryption: AES
Integrity: SHA-256+
▶️ Step 4 — Restrict SSH Access by Source
Create management ACLs to allow SSH only from:
Management VLAN
Trusted admin IP ranges
Bastion/jump hosts
Deny SSH from all other sources.
▶️ Step 5 — Enforce Authentication Controls
Use named admin accounts (no shared logins).
Integrate AAA (RADIUS/TACACS+) if available.
Apply RBAC to limit command access by role.
Enable account lockout and session timeouts.
▶️ Step 6 — Secure Keys and Credentials
Prefer SSH key-based authentication over passwords.
Protect private keys with passphrases.
Rotate credentials and keys periodically.
▶️ Step 7 — Enable Logging and Monitoring
Log:
Successful and failed SSH attempts
Configuration changes
Forward logs to a central syslog/SIEM.
Configure alerts for repeated failures or access from unusual IPs.
▶️ Step 8 — Test and Validate
Confirm Telnet access is blocked.
Verify SSH access works only from approved networks/users.
Review logs to ensure events are recorded correctly.
⚠️ Important Notes for Security+ Exam
Telnet = insecure → disable.
SSH v2 only with strong encryption.
Restrict management access using ACLs, VLANs, and AAA.
Prefer key-based authentication.
Logging and monitoring are essential for detection and response.
#Security
#SSH
#Telnet
#AccessControl
#NetworkHardening