DEMO: Console Passwords

Your network devices are the backbone of your network. You don't want somebody to compromise that, and so you have to think about security. Specifically, we're going to be talking about password security right now.

So when you're connected into this device, I'm connected to this device using line console 0, I hit enter and it doesn't prompt me for any password. That means that anybody that physically has access to this equipment can get onto it without any password. And then when I type in enable to get into the privileged EXEC mode, and it's privileged because you can do more advanced features and more advanced things within this mode, when I'm on it, it still doesn't prompt me for a password.

Setting an enable password

So I'm going to go into the global configuration. And once I'm in the global configuration mode, I'm going to type in enable password, and then I type in the password that I would like to have.

Now, I'm a big proponent of using a password manager to generate long passwords, to store them, to have a different password for every single device that's out there, and have something generate that password. So what I'm going to do is I'm going to copy and paste a complex password in here that's 16 characters, that's using uppercase and lowercase and numbers. And if the equipment can handle it, then you possibly look into special characters and that type of thing. So I've got this password here that I pasted into here that I would set on this device.

Now, for this purpose right here, I want us to be clear on which password belongs to which component, so we're going to be running some tests. In order to simplify this, for now I'm just going to type in that this is secret one. So it's some sort of secret one password, and I chose one because we'll have two and three here in a second. So, enable password secret one. So I'm putting a password on this device, and then I'm going to hit enter.

Let's see now what happens with this. I'm going to exit out of the device, and I hit enter. Notice to get into this device I still don't have a password. I go into the privileged EXEC mode, and now it asks me for a password. So I'm going to type in my secret one and hit enter, and now I'm into this device.

That's good, we've got now our device is secure. If anybody had access to this and they did a show running config and they go through here, they would actually be able to see pretty quickly that the enable password is secret one.

Using enable secret

So I'm going to show you now how to make a password that's not going to be in clear text. What I'm going to do is I'm going to get back into the global configuration. Instead of typing enable password, now I'm going to type in enable secret, and then I give it the password that I want. And so we're going to call this secret 2. So secret 2 is the password, the enable secret is the command here. So I'm going to enter.

And now I'm going to exit out of this, exit again, and then here it's asking me for a password. First of all I'm going to try the secret one, that's the one that's showing up in my running config that is not encrypted. I hit enter, it's incorrect, so it prompts me again. Now I'm going to type in secret, I hit enter, and now I'm on this device.

Let's see what it looks like in the running config. Remember it uses the secret 2 now, and the secret would be this one right here. Specifically it would be this line of characters right here. It's encrypted. The secret one still exists, it's just not operational. So this gets encrypted within the running config file. So that's an element of security that we'll want to implement, is we don't want things in clear text.

A password on the console line

So now we've got something on our privileged EXEC mode. Now let's create something that if somebody connects into this device, that requires a password as well. So what I'm going to do is I'm going to go into the global configuration mode, I'm going to type in line console 0. So this is when I'm connecting into that console port on the switch via my rollover cable. This is what I'm connected with, this is actually my terminal that I'm using to connect to it. So I'm going to type in a password for this and give it a password. So I'm going to give it a secret 3, and then hit enter. So now I have a password of secret 3.

Let's go ahead and check this out, see if it works. So at this point I'm going to get back out of my switch, I'm going to hit enter, and no, it didn't work, it hasn't worked. There's one more command that we need for this. So, conf t, and then I'm going to type in login. Essentially this turns that feature on. I'm not sure why, it's an extra command that you have to type in, but I have to type in login.

Once I do that, I can get out of here, get out of this machine right here. I'm going to hit enter, and now it's prompting me for passwords. So I'm going to type in my password. Now I'm in. So I typed in secret three, I'm in my device. Now I'm going to go into enable mode, my privileged EXEC mode, and type in secret 2.

Encrypting the passwords

Now let's look at the show running config. So now the problem with this: as part of that command I said give it the password. These password commands actually you can encrypt, there's a way to encrypt it, but I'm going to show you a little different way. So we see that the enable secret is encrypted. This one is not encrypted, it's just the way that I entered it into there from the beginning. I'm going to scroll to the bottom, because that's where I can find the config part of it for my line console 0. So you see my line console 0, those are the two that I've typed in there.

All right, so now what I'm going to do is, in the global configuration mode, I'm going to type in service password encryption, and then I'll hit enter. And now let's look at what this does. I'm going to do show running config, and notice that the password that I had before that said secret one is now encrypted. And then if I go to the end here, looking at my line console 0, it is also encrypted. So that service password-encryption allows us to encrypt the password on this device.

Backing the changes out

All right, now if I wanted to back out these changes, I could do the no enable secret. Oh, I need to be in my global config mode though. And no enable password, no enable secret, no service. And I get into my line console, I want no password in there, and no login.

So let's see if that all took. So I'm going to exit out of this, I hit enter, it doesn't prompt me. I go in enable mode, it doesn't prompt me again. So I backed out all those changes with those no commands.

So that's how you set up passwords. Now in actuality, once again, if this was equipment out there, I would want to put those passwords on there and keep them on there, so that way I could secure my equipment.