Hackers or corrupt IOS....

[jamin123]

Lately, every few days I am lock out my 2514 router which is connected to my Cable modem and LAN. After reseting password I lost all config. and I noticed the config-reg is mysteriously set to 0x141, and router boots into Ramon i.e, Router(boot)>

I am in the process of building a Linux Firewall for my Lab.

 

[BuckWeet]

Well for one, since that box is on your LAN, is it your NAT box? Also, if it is, do you have an access-list on the vty's? You could also do a "sh line" to view the history usage of the lines...


BuckWeet

 

[jamin123]

It is my NAT box. I've all kind of access-list, CAR and CBAC ip inspect. They seem to crack my enable secret and always lock me out. Once even the router name was changed.

I am running IP/FW IOS.

 

[marsd]

You obviously have a problem.
I would wipe the router's config, new passwords,
reflash it if you have a backup and reconfigure.

What services is this router offering?

 

[BuckWeet]

Sounds like you need to make better access-lists on the vty terminals, and also make sure there is a password on the aux and console ports (not sure if this is for personal use at home or at a business). Also come up with better enable secret passwords, because that password is not possible to crack (from my knowledge) i've never seen password crackers for it. But I have for the normal level 7 passwords.. Make better passwords for the vty's as well, and make sure its a different password for the enable secret.. Also, make sure SNMP isn't enable, if it is, assign an access-list so that only internal machines get access to it, same for the vty's.. Make sure that they aren't getting in through an internal machine as well.

Hope this helps

BuckWeet

 

[marsd]

If they hack you::
you are offering some braindead service
you have easily guessable passwords
they have trojaned your ios.

Don't take halfmeasures now..
reinstall.

 

[writemem]

Double check that you have the command "no ip http server" cisco will allow web access to the device through a browser and is pretty easy to crack

 

[jamin123]

no ip http server! Thanks you. It took me a few weeks to finally figured it out.

 

[Nocguy]

humm
just tried that command.

jupiter9#sh line
Tty Typ Tx/Rx Uses Noise Overruns Int
0 CTY 0 0 0/0 -
* 1 VTY 70 0 0/0 -
2 VTY 31 0 0/0 -
3 VTY 1 0 0/0 -

get's me a little worried,im i always using the same vty
when i'm telnetting ?
can i clear those counter's?
changed password and enable local ,will b that bit more
harder to hack if this is the case..