In this video, we're going to discuss the enable and secret passwords on Cisco devices.
In this example, I have a Cisco router and when I hit enter, I'm taken to user mode and then I can
type enable, which takes me immediately to enable or privilege mode.
There is no authentication at all, I'm immediately able to start configuring the router.
Now, from a security point of view, that's a really bad idea when someone connects to the console
of a router or switch, you typically want to have a password configured so that that person is not able
to go from the user mode to the enable or privilege mode without some type of security.
It's very risky to have a router configured without some type of authentication.
Now, in this example, in GNS3 it works a little bit differently, GNS3 routers take you
to privilege mode immediately.
So I'm going to open up a console to this Cisco router running in GNS3 and I'm told that I can press
enter to get started and I'm taken to privilege mode immediately. So if I type exit and hit enter notice
I'm taken to privilege mode straight away. On a real Cisco router, so a physical router
you can see in this example that I'm using a 2801.
When I type exit and then hit enter, I'm taken to user mode, not privileged mode, and then I need
to type enable to go to privilege mode.
Now, apart from that, you can test this entire lab on GNS3 because you can type disable and then
type enable and that takes you from user mode to privilege mode once again.
So the issue here is that when you connect to real routers via the console.
You can gain access to the router without entering a password, so we want to change this and add some
type of security.
So once again, when I'm in user mode and I type enable, I gain access to the router by default using
privilege level 15, which means I have all rights to the router without a password.
So let's change that.
So Configure Terminal or CONFT.
There are two ways to configure passwords for the enable mode or privilege mode
and when you type enable you'll see that you can configure a password for enable mode or a secret
password for enable mode.
So both of these assign a privilege, a level type of password.
Now the enable password is still in the Cisco CCNA which is surprising because it's a very weakway
of setting up passwords.
The reason why is the password is unencrypted as shown over here.
When you type in the password, you either specify 0, which means that the password you're going
to now type is in clear text or you specify 7, which means that the password is encrypted when
you type it in. By default, you don't have to put the 0 in, which means that the password you're
not typing is in clear text.
Now be careful hitting enter
at this point, you don't want a password of Cisco space.
So I'm going to press backspace and then hit enter.
So the password configured is enable password Cisco, control Z, or control Zed takes me back to privilege
mode and now I type show run.
You'll see the problem.
Notice the password is in clear text.
So if you were standing behind me looking over my shoulder, you'd be able to see what the password
is configured as well.
If I copied the configuration to a TFTP server and you opened up the file on the FTP server, you'd
also be able to see what the password is configured as.
So Cisco recommend that you change this default of no service password-encryption to service password
encryption to enable encryption of the password.
Now this is a trap,
don't be fooled by this encryption.
So firstly, when you type, show run or show running-config notice we've set service password
encryption and the password is now encrypted with a type 7 password.
However, if I copy that and paste it into a hacking tool, I'll make this tool available as part of
the course.
So you should see it below this video.
If I paste that password in and click show password, notice the password is decrypted, so this password
is only useful for stopping someone standing behind you, looking over your shoulder and seeing what
your password is.
It is not actually something that you should be using today, now just to confirm that if I type enable
password Cisco 1
and in this case, I'll use the do show run command, which means I'm running a show command from configure
mode and I'm going to specify pipe include enable to show only lines in the running-config with the
enable word notice
the password is different to what we had previously.
So back in my hacking application, I'll paste that in, notice
there's the password.
I'll set it back to Cisco,
look at it again.
Notice it's changed, but when I pasted in, the password is shown through this hacking tool, so don't
be fooled into using the enable password.
One more thing I'll point out and then I'll show you a better way of doing it is when you type enable
password,
notice the 7
that means that the password that follows is encrypted.
So if I put it in like that, it means that I've used a password of Cisco.
Now, how does this help me?
Well, when I typed disable and now I type enable notice, I need to put in a password of Cisco.
So the enable password command is used to stop someone moving from user mode to enable mode without
authentication.
You'll also notice that the password is not displayed.
It doesn't even show you the number of characters that you're typing.
So when I type enable nothing is displayed even though I'm typing the password.
So someone behind me wouldn't know how many characters my password is and you wouldn't know watching
this video.
So that's the enable password recommendation is don't use it because it's in clear text by default.
So once again, if I type no service password-encryption and then type do show run, the password is shown
the password is shown is encrypted here.
But if I change that to enable password, Cisco do show run password is shown in clear text.
So if you are going to use an enabled password and it's recommended that you don't it's recommended
that you use the service password encryption option to encrypt your passwords, societal support, the
enable password for backward compatibility
but it's not something you should be using in the real world.
Now, let's look at a better way of setting security for enable mode.