Securing GNU Zebra

First of all you should enable built-in features of all zebra daemons:

Example config:
service password-encryption
no banner motd
access-list localhost permit 127.0.0.1/32
line vty
 access-class localhost
After that only connections coming from localhost will be accepted. Now you should access your daemons via telnet 127.0.0.1 260x command.

Then you will wish to have remote access to CLI. There are some ways to do it:

  1. ssh to your router, then run telnet or ssh $ROUTER telnet localhost $DAEMON
    Merits: suitable for most setups.
    Drawbacks: each network administrator should have a shell access to the router, even for read-only access. Passwords are echoed to the terminal.
    Another way to reach the same is to setup an sshd subsystems on host machine:
    # sshd_config
    Subsystem szebra /usr/local/bin/szebra
    Subsystem sospfd /usr/local/bin/sospfd
    Subsystem sbgpd /usr/local/bin/sbgpd
    
    Create telnet wrappers:
    #!/bin/sh
    
    # zebra telnet wrapper
    /usr/bin/telnet localhost 2601
    
    Run ssh -s remote-machine szebra
  2. Use stunnel. (no example)
    Merits: does not require sshd or user accounts.
    Drawbacks: requires additional host setup and stunnel at each client side.
  3. Use custom shell script as login shell to make choice among ports user wishes telnet to.
    Merits: requires only one account without real shell access
    Drawbacks: requires additional setup.

Using vtysh, *NIX groups and sudo'ing will be described later.