Enable secret
The enable secret command provides better security by storing the enable secret password using a nonreversible cryptographic function. The added layer of security encryption provides proves useful in environments where the password crosses the network or is stored on a TFTP server.
enable secret [level level] {password | [encryption-type] encrypted-password}
You will not ordinarily enter an encryption type. Typically you enter an encryption type only if you paste into this command an encrypted password that you copied from a router configuration file.
If you use the same password for the enable password and enable secret commands, you receive an error message warning that this practice is not recommended, but the password is accepted. By using the same password, however, you undermine the additional security the enable secret command provides.
NOTE After you set a password using the enable secret command, a password set using the enable password command works only if the enable secret is disabled or an older version of Cisco IOS Software is being used, such as when running an older rxboot image. In addition, you cannot recover a lost password that has been encrypted.
An enable password is defined as follows:
■ It must contain from 1 to 25 uppercase and lowercase alphanumeric characters
■ It must not have a number as the first character.
■ It can have leading spaces, but they are ignored. However, intermediate and trailing spaces are recognized.
■ It can contain the question mark (?) character if you precede the question mark with the key combination Crtl-V when you create the password.
Example 5-3 specifies the enable secret password of ladyhawk
Example 5-3 Enable Secret Password Configuration
Router(config)#enable secret ladyhawk
Configuring Multiple Privilege Levels 87
After you specify an enable secret password, users must enter this password to gain access. Any passwords set through enable password will no longer work.
In addition to the enable secret password, the username secret command provides an additional layer of security over the username password. It also provides better security by encrypting the password using nonreversible Message Digest 5 (MD5) encryption and storing the encrypted text. The added layer of MD5 encryption proves useful in environments in which the password crosses the network or is stored on a TFTP server. This command was introduced in Cisco IOS Software Release 12.0(18)S. The syntax to encrypt a user password with MD5 is as follows:
username name secret {[0] password | 5 encrypted-secret}
Example 5-4 illustrates the use of the username secret command
Example 5-4 The username secret Command
IRouter(config)# username Aida secret 0 ysf600
Continue reading here: Configuring Multiple Privilege Levels
Was this article helpful?