Change passwords often
When creating passwords for Cisco routers, always keep these rules in mind:
■ It is best to have a minimum of 10 characters for a password. Passwords may include the following:
— Any alphanumeric character
— A mix of uppercase and lowercase characters
— Symbols and spaces
■ Passwords should not use dictionary words.
■ Password-leading spaces are ignored, but all spaces after the first character are not ignored.
■ You should decide when and how often the passwords will be changed.
You may want to add your own rules to this list to make your passwords even safer.
© 2006 Cisco Systems, Inc. Securing the Perimeter 2-27
If you are working on a new router (from the factory) or an existing router that has been reset (possibly using the Cisco password-recovery procedure), you are prompted by the Cisco IOS command-line interface (CLI) when you want to enter the initial configuration dialog. The figure provides a router configuration sample with this initial prompt.
Within the first few questions of the initial configuration dialog, several Cisco router password requirements can be found.
■ The router enable secret password
■ The router enable password
■ The password used to access the router using vty (Telnet)
The enable secret password is used to enter enable mode (sometimes referred to as privileged or privileged EXEC mode). You can set the enable secret password by entering a password during the initial configuration dialog (as shown in the figure), or by using the enable secret command in global configuration mode. The enable secret password is always encrypted inside the router configuration using a Message Digest 5 (MD5) hashing algorithm.
The enable password command is also used to enter enable mode, but it is from older versions of Cisco IOS software. By default, the enable password is not encrypted in the router configuration. Cisco decided to keep the older enable password command in later versions of Cisco IOS software even though enable secret password is a safer way to store privileged EXEC passwords. The older command was kept in case the router is downgraded to a version of Cisco IOS software that did not support an enable secret password. The enable password protects the privileged EXEC administrative router access.
The vty password is the line-level password entered when connecting to the router using Telnet. You can set this password during the initial configuration dialog (as shown in the figure) or by using the password command in vty configuration mode.
2-28 Securing Cisco Network Devices (SND) v2.0 © 2006 Cisco Systems, Inc.
Continue reading here: Sets the minimum length of all Cisco IOS passwords
Was this article helpful?