Cisco Catalyst 2960 Series, Configuration Manual

Page: 1072 / 2288

Opening a Telnet Session to a Device
To use Kerberos to authenticate users opening a Telnet session to the device from within the network, use the
following command in global configuration mode:
Purpose Command
Sets login authentication to use the Kerberos 5 Telnet
authentication protocol when using Telnet to connect
to the device.
Device(config)#
aaa authentication login
{
default
| list-name
}
krb5_telnet
Although Telnet sessions to the device are authenticated, users must still enter a clear text password if they
want to enter enable mode. The
kerberos instance map command, discussed in a later section, allows them
to authenticate to the device at a predefined privilege level.
Establishing an Encrypted Kerberized Telnet Session
Another way for users to open a secure Telnet session is to use Encrypted Kerberized Telnet. With Encrypted
Kerberized Telnet, users are authenticated by their Kerberos credentials before a Telnet session is established.
The Telnet session is encrypted using 56-bit Data Encryption Standard (DES) encryption with 64-bit Cipher
Feedback (CFB). Because data sent or received is encrypted, not clear text, the integrity of the dialed device
or access server can be more easily controlled.
This feature is available only if you have the 56-bit encryption image. 56-bit DES encryption is subject
to U.S. Government export control regulations. Note
To establish an encrypted Kerberized Telnet session from a device to a remote host, use either of the following
commands in EXEC command mode:
Purpose Command
Establishes an encrypted Telnet session.
Device(config)#
connect
host
[ port
]
/encrypt kerberos
or
Device(config)#
telnet
host
[ port
]
/encrypt kerberos
When a user opens a Telnet session from a device to a remote host, the device and remote host negotiate to
authenticate the user using Kerberos credentials. If this authentication is successful, the device and remote
host then negotiate whether or not to use encryption. If this negotiation is successful, both inbound and
outbound traffic is encrypted using 56-bit DES encryption with 64-bit CFB.
When a user dials in from a remote host to a device configured for Kerberos authentication, the host and
device will attempt to negotiate whether or not to use encryption for the Telnet session. If this negotiation is
successful, the device will encrypt all outbound data during the Telnet session.
If encryption is not successfully negotiated, the session will be terminated and the user will receive a message
stating that the encrypted Telnet session was not successfully established.
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
990
How to Configure Kerberos