In this video we're going to discuss the Enable and secret passwords on Cisco devices.
In this example I have a Cisco router and when I hit Enter I'm taken to user mode and then I can type
enable Which takes me immediately to enable or privilege mode.
There is no authentication at all.
I'm immediately able to start configuring the router from a security point of view.
That's a really bad idea.
When someone connects to the console of a router or switch you typically want to have a password configured
so that that person is not able to go from the user mode to the Enable or privilege mode without some
type of security.
It's very risky to have a router configured without some type of any cation.
Now in this example ingenius three it works a little bit differently jenius three routers take you to
privilege mode immediately.
So I'm going to open up a console to this Cisco router running in Janissary And I'm told that I can
press enter to get started and I'm taken to privilege mode immediately.
So if I type exit and hit enter notice I'm taken to privilege mode straight away on a real Cisco router.
So a physical router you can see in this example that I'm using a 12:32 when I type exit and then hit
Enter I'm taken to user mode not privilege mode and then I need to type be able to go to privilege mode
now.
Apart from that you can test the entire lab on Jena's 3 because you can type disable and then type enable
and that takes you from user mode to privilege mode once again.
So the issue here is that when you connect to real routers via the console you can gain access to the
Rodda without entering a password.
So we want to change this and add some type of security.
So once again when I'm in user mode and I type the Enable I gain access to the router by default using
privilege level 15 which means I have all rights to the router without a password.
So let's change that so configured terminal Confiteor.
There are two ways to configure passwords for the Enable mode or privilege mode when you type enable.
You'll see that you can configure a password for Enable mode or a secret password for Enable mode.
So both of these assign a privilege level type of password.
Now the Enable password is still in the Cisco CCMA which is surprising because it's a very weak way
of setting up passwords.
The reason why is the password is unencrypted as shown over here.
When you type in the password you either specify 0 which means that the password you're going to now
type is in clear text or you specify 7 which means that the password is encrypted when you type it in.
By default you don't have to put the zero in.
Which means that the password you are typing is in clear text.
Now be careful hitting enter at this point you don't want a password of Cisco space.
So when I press backspace and then hit enter.
So the password configured is enabled password Cecka control zero controls it takes me back to privilege
mode.
And now for top show run you'll see the problem.
Notice the password is in clear text.
So if you were standing behind me looking over my shoulder you'd be able to see what the password is
configured as a way for copy the configuration to a TFT piece over and you opened up the file on the
TFT piece.
You'd also be able to see what the password is configured as.
So Cisco recommend that you change the default of no service password encryption to service password
encryption to enable encryption of the password.
Now this is a trap.
Don't be fooled by this encryption.
So firstly when you type show run or show running config notice reset set service password encryption
and the password is now encrypted with a type seven password.
However if I copy that and paste it into a hacking tool now makes this tool available as part of the
course.
So you should see it below the video if I paste that password in and click Show password.
Notice the password is decrypted.
So this password is only useful for stopping someone standing behind me looking over your shoulder and
seeing what your password is.
It is not actually something that you should be using today.
Now just to confirm that that type enabled password Cisco one and in this case I'll use the do show
run command which means I'm running a show command from configure mode and I'm going to specify pipe
include enable to show only lines in the running config with the Enable word Notice the password is
different to what we had previously.
So back in my hacking application I'll paste that in.
Notice there's the password.
I'll send it back to Cisco.
Look at it again.
Notice it's changed but when I pasted in the password is shown through this hacking tool.
So don't be fooled into using the Enable password.
One more thing I'll point out and then I'll show you a better way of doing it.
So when you type enabled password notice the seven that means that the password that follows is encrypted.
So if I put it in like that it means that I've used a password of Cisco.
Now how does this help me.
Well when I type disable and now type enable notice I need to put in the password of Cisco So the enabled
password command is used to stop someone moving from user mode to enable mode without any cation.
You'll also notice that the password is not displayed.
It doesn't even show you the number of characters that you typing so when I type in table nothing is
displayed even though I'm typing the password.
So someone behind me wouldn't know how many characters my password is.
And you wouldn't know.
Watching this video.
So that's the Enable password recommendation is don't use it because it's unclear text by default.
So once again foretop no service password encryption and then type do show run.
The password is shown as encrypted here.
If I change that to enable password Cisco do show run passio to shown in clear text.
So if you are going to use an enabled password and it's recommended that you don't it's recommended
that you use the service password encryption option to encrypt your passwords.
Cisco still support the enabled password for backward compatibility but it's not something you should
be using in the real world.
Now let's look at a better way of setting security for Enable mode.