Cisco Certified Expert

Simple Password Protection for the CLI

Figure 21-1 provides a visual reminder of some hopefully familiar details about how users can reach a router's CLI user mode, and move into enable (privileged) mode using the enable command.

Figure 21-1 Router User and Enable Modes

Figure 21-1 shows three methods to reach user mode on a router. The figure also applies to Cisco IOS-based switches, except that Cisco switches do not have auxiliary ports.

Cisco IOS can be configured to require simple password protection for each of the three methods to access user mode. To do so, the login line subcommand is used to tell Cisco IOS to prompt the user for a password, and the password command defines the password. The configuration mode implies for which of the three access methods the password should be required. Example 21-1 shows a simple example.

router>enable password: zzzzz router#

Figure 21-1 Router User and Enable Modes router>enable password: zzzzz router#

router#disable router>

Enable Mode router#disable router>

Enable Mode

Example 21-1 Simple User Mode CLI Password Protection

! The login and password	commands	under line con 0 tell the router to supply a password
! prompt, and define the	password	required at the console port, respectively.
line con 0
login		!
line vty 0 15
login
password barney

These passwords are stored as clear text in the configuration, but they can be encrypted by including the service password-encryption global command. Example 21-2 shows the results of adding this command.

Example 21-2 Using the service password-encryption Command

! The service password-encryption global command causes all existing	clear-text
! passwords in the running config to be encrypted.
service password-encryption
! The "7" in the password commands means that the following value is	the
! encrypted password per the service password-encryption command.
line con 0
password 7 05080F1C2243
login
line vty 0 4
password 7 00071A150754
login

Note that when the service password-encryption command is added to the configuration, all clear-text passwords in the running configuration are changed to an encrypted value. The passwords in the startup configuration are not changed until the copy running-config startup-config (or write memory for all you fellow old-timers out there) command has been used to save the configuration. Also, after disabling password encryption (no service password-encryption), passwords are not automatically decrypted—instead, Cisco IOS waits for a password to be changed before listing the password in its unencrypted form.

Note that the encryption used by the service password-encryption command is weak. Publicly available tools can decrypt the password. The encryption is useful to prevent the curious from logging into a router or switch, but it provides no real protection against even a hacker with modest ability.

Better Protection of Enable and Username Passwords

The password required by the enable command can be defined by either the enable password pw command or the enable secretpw command. If both are configured, the enable exec command only accepts the password defined in the enable secret command.

The password in the enable password command follows the same encryption rules as login passwords, only being encrypted if the service password-encryption command is configured. However, the enable secret password is not affected by service password-encryption. Instead, it is always stored as an MD5-hashed value, instead of being encrypted, resulting in a much harder to break password. Example 21-3 shows how Cisco IOS represents this subtle difference in how the password values are stored.

Example 21-3 Differences in Hashed/Encrypted Enable Passwords

KEY POINT

The enable password lists a 7 in the output to signify an encrypted value per the service password-encryption command; the enable secret command lists a 5, signifying an MD5-hashed value, service password-encryption !

enable secret 5 $1$GvDM$ux/PhTwSscDNOyNIyr5Be/ enable password 7 070C285F4D064B

The username name password password command has a feature similar to the enable secret command. The service password-encryption command encrypts the password listed in the username name password password command; however, the username name secret password command uses the same MD5 hash as the enable secret command to better protect the password. And, as with enable secret, a 5 is listed in the command as stored in the configuration—for example, username barney secret 5 $1$oMnb$EGf1zE5QPip4UW7TTqQTR.

0 0