Lesson 2

How to set Password on Cisco Devices

To protect Cisco routers and switches from unauthorized access, we need to set a secure password. Cisco IOS commonly uses passwords to protect:

  • Privileged EXEC mode: Prevents unauthorized users from entering privileged mode.
  • Console access: Controls physical access through the console port.
  • Remote access: Protects remote login through VTY lines, such as Telnet or SSH.

Configuring a Password for Privileged EXEC Mode

When we connect to a Cisco router or switch, we initially enter User EXEC mode, which is represented by the > prompt. To access Privileged EXEC mode, represented by the # prompt, we use the enable command. By default, there may be no password required to enter this mode. We can configure an enable password to protect it.

  1. Enter Global Configuration Mode

    Router> enable
Router# configure terminal
Router(config)#

  2. Configure an Enable Password

    Router(config)# enable password cisco123

Here, enable password configures a password for entering Privileged EXEC mode.

Complete Command Sequence

Router>enable
Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#enable password cisco123
Router(config)#end
Router#
%SYS-5-CONFIG_I: Configured from console by console

Here, end command goes back to Privileged EXEC mode from the Global Configuration mode.

Verify the Configuration

Router# show running-config

You may see the password here:

Building configuration...

Current configuration : 634 bytes
!
version 16.6.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
!
enable password cisco123
!
!
!
!
!
!
ip cef
no ipv6 cef

Demerits of Using an Enable Password

Using a traditional enable password has several security weaknesses. By default, the password is stored in plain text in the device configuration, making it easy to read by anyone who has access to the configuration file. If an unauthorized person gains access to the configuration, they can immediately see the password and use it to access privileged EXEC mode. Therefore, it provides very little protection for sensitive device access.

Encrypting Passwords with Service Password-Encryption

Cisco IOS provides a command called service password-encryption to hide plain-text passwords in the device configuration.

Router#conf ter
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#service password-encryption

Now, check the running configuration and You can see the enable password 7 0822455D0A16544541 instead of enable password cisco123

Router(config)#do show running-config
Building configuration...

Current configuration : 643 bytes
!
version 16.6.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
service password-encryption
!
hostname Router
!
!
!
enable password 7 0822455D0A16544541
!
!
!
!
!
!
ip cef
no ipv6 cef

The password is now displayed in an encoded format instead of plain text. The number 7 indicates that Cisco is using Type 7 password encryption. However, Type 7 does not provide strong security because it can be easily reversed. Anyone who gets access to the encoded password can use a publicly available online tool to convert it back to the original password.\

Configuring Enable Secret Instead of Enable Password

Cisco provides another command called enable secret. It is designed to protect access to Privileged EXEC mode using a one-way password hash. Let’s configure it.

Router>enable
Password:
Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#enable secret ciscoSecret123

Verify the Enable Secret Configuration

Here, You can see the enable secret 5 $1$mERr$w/5bigBef0/jW26K4O9Sp1 instead of the enable secret ciscoSecret123

Router(config)#do show running-config
Building configuration...

Current configuration : 690 bytes
!
version 16.6.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
service password-encryption
!
hostname Router
!
!
!
enable secret 5 $1$mERr$w/5bigBef0/jW26K4O9Sp1
enable password 7 0822455D0A16544541
!
!
!
!
!
!
ip cef

Comments

100%