The Cisco IOS login command activates authentication on a configured line. With a line password, it requires users to enter that password before reaching user EXEC mode; configuring password alone has no effect. section 5.1.1
Use login local instead when authentication should use locally configured user accounts. The two commands are mutually exclusive: configuring one overwrites the other. login uses the line password even when user accounts exist, while login local requires a username and account password. section 5.1.2
Configure the command in line configuration mode:
- Enter line con 0 for the console line or line vty 0 15 for the VTY lines. section 5.1.1 section 5.2.2
- For line-password authentication, configure password password followed by login. section 5.1.1
- For local-account authentication, configure username username secret password globally, followed by login local under the line. section 5.1.2
- Use login local for Telnet or SSH VTY access; remote users still need an enable secret to enter privileged EXEC mode. section 5.2.2 section 5.3.2
Console line using a line password
SW1(config)# line con 0 SW1(config-line)# password cisco SW1(config-line)# login A connecting user receives a Password prompt and reaches SW1> after successful authentication. The default inactivity timeout is 10 minutes; change it with exec-timeout minutes. section 5.1.1
VTY lines using local accounts
SW1(config)# username jeremy secret ccna SW1(config)# line vty 0 15 SW1(config-line)# login local Telnet or SSH users enter the configured username and password, then reach user EXEC mode. VTY lines can also apply transport restrictions, access lists, and inactivity timeouts. section 5.2.2 section 5.3.2
SW1(config)# line con 0 #1 SW1(config-line)# password cisco #2 SW1(config-line)# login #3 #1 Configures console line 0 #2 Configures the line password #3 Requires the line password to access the console line
Shows the three-command sequence that configures a console line password and makes login require it. section 5.1.1
