ccna 200-301 official book

ccna 200-301 official book.access the device. The following commands can be used to enhance the login feature.Router(config)# login block-for-seconds attempts tries within seconds Router(config)# login quiet-mode access-class ( acl-name | acl-number } Router (config)# login delay seconds Router(config)# login on-success log [ every login ] Router(config)# login on-failure log [ every login ]Note: These enhanced features are enabled only when local and remote access is authenticated using the local database. If the access line is configured to authenticate with a password only, the enhanced login features cannot be enabled.2.1.3.3 Enabling Login EnhancementThe loginblock-for command can be used to enable Cisco1OS devices to provide DoS detection, provided that the IOS device is configuredfor the login enhancement feature to be enabled. Until the loginblock-for command is configured, all other login enhancement features are disabled. Specifically, the loginblock-for command monitors the behavior of the login device and operates in two modes. Normal mode: also known as watch mode. The router records the number of failed logins within a defined time period.Silent mode: also known as silent period. If the number of failed logins exceeds the configured threshold. all login attempts using Telnet. SSH and HTTP are denied for the time period specified in the loginblock-for command.With silent mode enabled, all login attempts, including legitimate administrative access, are not released. However, to make critical hosts (such as those exercising administrative purposes) accessible at all times, ACLs can be used to resolve the issue. ACLs are created and identified using the login quiet-mode access-class command. Only the hosts identified by the ACL can access the device during the quiet period.By default, the CiscoIOS device accepts connections such as Telnet.SSH and HTTP as fast as it can handle them. This makes the device vulnerable to password attacks. To try to discover administrative passwords, an attacker might use a password auditing tool such as Cain or LOphtCrack, which can perform thousands of password attempts per second.When the loginblock-for command is executed, it can automatically generate a 1-second delay between logins. This can significantly reduce the efficiency of password auditing tools. To make things more difficult for attackers, the time delay between login attempts can be changed using the logindelay command 0 The logindelay command introduces a uniform delay between two successful logins. The delay occurs for all login attempts, including both failed and successful attempts.