So at the moment I've configured and enabled password of Cisco nocive is password encryption is configured.
Which means that the password shown in clear text the advantage of an enable password is when I type
enable I'm AWST to enter a password.
When you connect to a live router by default you're in user mode and if an enable password hasn't been
configured you are immediately able to access privilege mode or enable mode.
But when a password is configured you'll be prompted to enter the password before you can access that
mode.
Now Cisco recommend that you use enable secret rather than in a password.
And that's because this uses a better encryption uses empty five hashing to hash a password.
I'll show you a demonstration of hashing in a moment in a similar way to the Enable password.
We can enter it zero which means we entering the password as unencrypted or 5 which means that the password
that follows is encrypted.
You don't have to enter Zerah by default either.
So I'm just going to say enable secret Cisco.
But notice what happens I'm told that the Enable secret you have chosen is the same as the Enable password.
This is not recommended.
Re-enter the Enable password when a top show run pipe include enable.
You'll notice it did except the secret password but I'm told that I should re enter the password.
So let's follow Cisco's advice and I'll set the password to Hello.
So enable secret Hello.
Now when I typed controls that are control Z and disable and top enable I'm actually typing Hello rather
than Cisco to access the privilege mode or enable mode when I type show run will do the full running
config so that you can see it in the output.
Notice nocive is possible encryption is configured but the secret password is hashed.
It's encrypted by default.
You can't decrypt that in the same way that I showed you using the hacking tool.
The hacking tool only works with top seven passwords.
And this is a lot more secure than Top 7.
Now I've shown you how to hack type 7 password.
It's not as easy to do that with a empty five password.
This tool is also available as part of the course.
Look below the Vidia to use it.
This is a hashing application that shows the empty five hashing versus Shaw hashing versus Shaar 256
schaw 512 and Shaw 384 M.D five hashes 128 bits in length and it's actually recommended for VPN or virtual
private networks that you don't use empty five hashes.
But Siska rod is still using M.D five hashes for the secret password.
If I configure a password of Cisco and then click cache this application will show me the hexadecimal
hash of that password the binary hash as well as the Shaw hashes of that password.
And what you'll notice is the Shaw passwords are a lot longer.
These are hex values.
So each of value that you see here is four binary ones.
These are going to be a lot longer and a lot more secure than an empty five hash of 128 bits.
But for now keep your eye on the binary and the empty five and all I'm going to do is add one more character.
So at a one at the end and click hash again and what you should have noticed is that the hash changed
quite dramatically from the previous example.
Notice that the NGF 0 8 1 6 when I put another character in and I'll just put in a dot hash.
Notice the entire number has changed.
So even a minor change in the source text will cause the hash to change entirely.
So in other words if you change your password the whole hash changes.
So it's much more difficult for someone to try and crack this password than say using service password
encryption.
So once again recommend that you use a secret password rather than an enable password.
Let's look at functionality of the passwords.
Radu one has an enable and secret password configured router to at the moment doesn't have a password
configured all but the Rodda and open up a console so top disable and rotten do the same on router.
When I tap enable on Rotto one I need to enter my password which is my secret password and router 2
I don't have to enter anything because no password is being configured.
If Alltop been able and to do nothing.
The road is going to wait for a period of time for me to enter a password and if I don't it's going
to prompt me I'll speed up the video to save you the time waiting for this but notice the time it has
expired that's going to happen three times.
While we're waiting for that I'll set up an enable password on route to
and I'll show you what happens when I've touched the wrong parts but in seminar type in Ponsford one
possible to prosper to three.
Notice it tells me bad passwords so I'm not locked out of the router.
I'm simply told that I've entered a bad number of passwords notice and wrote a one second time that
has occurred on Rodek t it's doing enable secret Cecka one disable.
Now this is going to be my secret password.
One two three told bad secrets.
Previously I was told bad passwords on Rato one I'm told bad secrets because I've had three timeouts.
So the moral of the story is that if you wait too long you'll be prompted again offers free incorrect
tri's of a password.
It reverts back to user mode and that's the default behavior.
It's not going to lock you out of the router.
You can enable more security but that's not covered in the CCN a course so I won't explain it here but
you can lock someone out of a router if you want to and something to take note of is show run piping
Kloot enable you can't use this as your password.
So copy that time disable and pasted in but it's not accepted as a password.
So I'll say no.
Enable secret
show run pipe.
Include.
Enable.
So my password is Siska top civis password encryption show run piping CLEET enable my cryptic password.
I'll try and paste that in when prompted for a password and it's not accepted.
I need to use my unencrypted password when going from user mode to enable mode.