Looking at SHOW CONFIG output, how would I verify the following?

[anghang]

what would I be looking for in the output with regards to:
(yes, i'm a total newbie at this)

1. dynamic routing protovols are invoked?
2. timeout session setting value?
3. finger is disabled?
4. IP redirect broadcasts is enabled/disabled?
5. TCP/UDP services are enabled/disabled?
6. no router specific banners being used

 

[jneiberger]

Ah...I can see that, once again, someone who knows nothing about Cisco routers has been placed in charge of security. LOL Just kidding, I promise! That's just a rather common thing to happen, I'm afraid.

1. Look for commands beginning with the word "router", such as "router rip", "router ospf", or "router eigrp"

2. Look for commands starting with "exec-timeout"

3. Look for "no service finger". This may be the default setting on newer software images so it might not show up in the config.

4. Look for "no ip directed-broadcast" and make sure no ip helper-addresses are configured where they are not necessary

5. "no service udp-small-servers" and "no service tcp-small-servers". Again, these are probably the default settings on newer IOS images and they won't show up in the config

6. Look for any command starting with "banner".

HTH,
John

 

[anghang]

excellent!...thanks!...

no offense taken...i'm still learning the defensive side of things...was always used to attacking but now that the market is saturated with pentesters (many of which are sloppy) it brings down my value...seems that defense is doing well tho

 

[MTandSAV]

what might give you some info, is to install look@lan on a pc and scan your router. It will tell you whats open -for example ip finger- and whats not.
nothing fancy and should just be used as a little help.
sh ip route gives you info on the routing protocols

CCNA, CCNP..partly

 

[jneiberger]

Another point..."show config" shows you the startup config of the router, not what's currently running on it. If you want to see what's currently happening on the device then you should use "show running-config" instead. Heck, you should probably avoid "show config" altogether just because it's confusing. You could replace that command with "show startup-config".

HTH,
John