Encrypting Passwords; Configuring Multiple Privilege Levels - Cisco 6500 Series Software Configuration Manual
Hide thumbs
Also See for 6500 Series:
- Configuration manual (392 pages) ,
- Configuration note (212 pages) ,
- Installation manual (194 pages)
Table of Contents
Advertisement
Chapter 3
Configuring the Switch for the First Time
When you set TACACS password protection at the privileged EXEC mode, the enable EXEC command
prompts for both a new username and a password. This information is then sent to the TACACS+ server
for authentication. If you are using the extended TACACS+, it also sends any existing UNIX user
identification code to the TACACS+ server.
If you enter the enable use-tacacs command, you must also enter tacacs-server authenticate enable,
Caution
or you are locked out of the privileged EXEC mode.
When used without extended TACACS, the enable use-tacacs command allows anyone with a valid
Note
username and password to access the privileged EXEC mode, creating a potential security problem. This
problem occurs because the switch cannot tell the difference between a query resulting from entering the
enable command and an attempt to log in without extended TACACS.
Encrypting Passwords
Because protocol analyzers can examine packets (and read passwords), you can increase access security
by configuring the Cisco IOS software to encrypt passwords. Encryption prevents the password from
being readable in the configuration file.
To configure the Cisco IOS software to encrypt passwords, perform this task:
Command
Router(config)# service password-encryption
Encryption occurs when the current configuration is written or when a password is configured. Password
encryption is applied to all passwords, including authentication key passwords, the privileged command
password, console and virtual terminal line access passwords, and Border Gateway Protocol (BGP)
neighbor passwords. The service password-encryption command keeps unauthorized individuals from
viewing your password in your configuration file.
Caution
The service password-encryption command does not provide a high level of network security. If you
use this command, you should also take additional network security measures.
Although you cannot recover a lost encrypted password (that is, you cannot get the original password
back), you can regain control of the switch after you lose or forget the encrypted password. See the
"Recovering a Lost Enable Password" section on page 3-19
To display the password or access level configuration, see the
and Privilege Level Configuration" section on page
Configuring Multiple Privilege Levels
By default, the Cisco IOS software has two modes of password security: user EXEC mode and privileged
EXEC mode. You can configure up to 16 hierarchical levels of commands for each mode. By configuring
multiple passwords, you can allow different sets of users to have access to specified commands.
78-14099-04
Purpose
Encrypts a password.
Catalyst 6500 Series Switch Cisco IOS Software Configuration Guide—Release 12.1 E
Protecting Access to Privileged EXEC Commands
if you lose or forget your password.
"Displaying the Password, Access Level,
3-19.
3-17
Advertisement
Table of Contents
Troubleshooting
