So although we stored the passwords with a strong encryption algorithm, it's still not safe to let
just anyone access the password hashes because they're still open to the offline password cracking attacks.
So it's possible to identify access control lists for the communication services such as SNMp, SSH
and Telnet with these access lists.
We can decide who can and cannot connect to the services.
Then close the services for everybody else.
So there are two types of access lists, standard and extended.
Let's have a look.
We can see how we can manage the access to the router.
So once again, we are back in the network we created by using Gns3.
All the devices are still active and running.
That's always a good sign.
Open the Router's console.
And enter the config terminal mode.
Access list is the key word to create and configure access control lists.
So put a question mark to see the options.
The number here decides the type of the access list.
We'll make an example of standard access.
So just put a number between 1 and 99.
I'll just put two.
A standard access control list either denies or permits source IP addresses.
In addition, a source IP addresses an extended access control list can also deny or permit based on
destination IP addresses, ports and those services as well.
Question mark again.
And these are the options we can either deny or permit a connection request.
So let's decide who to permit first question mark to see the options.
Okay.
We can put a pattern here.
So the computer's matching the pattern are allowed.
If we use any here, that means we permit all computers except ones which are identified by the deny
and the access list.
Alternatively, we can permit directly to any specified computer.
So here I'll use host as the option and let my collie access to it.
So let me look at the IP address of the collie.
10.3.
I want to deny all others.
So access list to deny any.
Now the next thing we have to do is go to the line Vty and apply this access list to the interface.
Good.
So type line vty zero four to enter line config.
In the line config we'll use access list command.
Number of access lists first and now a question mark to see the options.
And look at that.
There are two options in and out.
Now, since we're going to be telnetting into the router we're going to use in.
Exit or control C to exit from the line config mode.
Now I want you to see the running config.
So type show run.
And here is the running config.
So scrolling down, I'll show you the access list and make sure that everything's right.
So here it is.
And yeah, as you can see, we have our access list to to permit and deny any other host attempting
to make a Telnet connection.
Now let's test whether the access list works as intended.
So back in my network, I have other VM machines like Kali.
One of them is a Wasp PWA.
As you know, and its IP address is 10.4.
First, I want to check if the network is okay and Owasp sees the router.
So ping 192.168.10.1 and sure enough we have the replies.
Now I want to create a telnet connection to the router.
So type telnet and the router IP.
Hit enter connection is refused.
Well, that's what's supposed to be right.
That means the deny part of the access list is working properly.
What about the permit part?
So go to Cali in terminal screen Telnet, enter the router and as you can see, we can telnet into the
router.
The request is not refused and we are allowed to telnet from Cali.
So to double check, I'll run an Nmap query to check whether the telnet port of the router is open.
And yes, of course it is.